With 2025–26 audits under way, some self-managed super fund trustees will learn their auditor has lodged, or plans to lodge, an auditor contravention report with the ATO. The news can feel alarming. Yet an ACR is a reporting step, not a verdict. Understanding when auditors must report, and how the ATO typically responds, may help trustees respond calmly and constructively.

What an auditor contravention report actually is

Every SMSF must be audited each year by an approved SMSF auditor. As part of the compliance audit, the auditor checks whether the fund has met key rules in the Superannuation Industry (Supervision) Act 1993 and its regulations.

If, in the normal course of the audit, the auditor forms the opinion that a contravention may have occurred, is occurring or may occur, and it meets the ATO's reporting criteria, an ACR must be lodged. According to the ATO, this must happen within 28 days of completing the audit.

Auditors are also required to tell trustees in writing about contraventions they identify. Trustees therefore usually hear about an issue before or alongside any report to the regulator.

The reporting criteria auditors must apply

Auditors do not have unlimited discretion about what to report. The ATO's ACR instructions set out a series of tests.

Breaches of the SMSF definition in section 17A, or a disqualified person acting as trustee, are always reportable. For funds less than 15 months old, if any single contravention exceeds $2,000, all reportable contraventions must be reported.

Repeat breaches, contraventions from earlier years still unresolved at the audit date, and statutory deadlines missed by more than 14 days are also reportable. So are contraventions worth more than 5 per cent of the fund's total assets, or more than $30,000 in total.

The ATO also notes that auditors may use professional judgement to report matters that fall outside these tests, for example where they cannot obtain sufficient evidence to support an asset's market value.

A report often reflects that a technical threshold has been crossed, rather than a finding that trustees acted dishonestly.

Why most reports are not a crisis

The ATO has repeatedly indicated that most SMSFs are compliant. In an October 2022 speech, an ATO assistant commissioner said 97 per cent of SMSFs that lodged had no reportable contraventions, while ACRs were lodged for 13,558 funds in 2022.

In a February 2024 address, Deputy Commissioner Emma Rosenzweig said the vast majority of SMSFs are doing the right thing. The same speech noted that loans to members, illegal early access and in-house asset breaches accounted for a significant share of reported contraventions.

These figures are several years old, and current numbers may differ. Still, they suggest that an ACR places a fund in a relatively small group that attracts closer attention, not automatically in the enforcement queue.

What the ATO does after receiving an ACR

The ATO says once it receives a report, it reviews the contravention alongside other information it holds before deciding what further action, if any, to take.

Its published range of responses is broad and graduated. At the lighter end, the ATO can issue an education direction, requiring a Trustee to complete an approved SMSF trustee education course within a set period and then sign a trustee declaration within 21 days of finishing.

A rectification direction requires trustees to take specified steps to fix a breach within a set timeframe and provide evidence that they have done so. Trustees may also offer an enforceable undertaking: a written commitment outlining how and when they will rectify the problem and prevent it recurring.

Where the consequences become more serious

For more significant or repeated breaches, the stakes rise. Administrative penalties of between 5 and 60 penalty units can apply, depending on the rule broken, with the higher end applying to breaches such as lending to members or exceeding in-house asset limits. The ATO states that these penalties must be paid personally and cannot be paid from fund assets.

The ATO can also disqualify trustees it considers are not fit and proper, with names published on a public register. In the most serious cases, a fund may be made non-complying, which can mean the loss of tax concessions and Assets being taxed at the highest marginal rate. Civil and criminal penalties are also available for serious contraventions.

The ATO lists factors it weighs when deciding on action, including the seriousness of the breach, whether it has been rectified, the trustees' knowledge and the fund's compliance history. Outcomes therefore depend on individual circumstances.

What trustees may want to consider

Engaging promptly with the auditor may help. Asking what was reported, under which criterion, and whether the breach has been fully rectified can clarify the position before any ATO contact.

Fixing the underlying problem quickly also counts. A Loan to a member repaid, an asset properly separated or a missed deadline met may change how the ATO views the matter, although rectification does not necessarily prevent a report being lodged.

The ATO also runs an early engagement and voluntary disclosure service. It says trustees who come forward about unrectified contraventions will have their actions taken into account, and this may reduce penalties.

Keeping clear records, updating the fund's Investment strategy where relevant and reviewing processes can reduce the risk of the same issue recurring. Because repeat breaches are themselves reportable, prevention may be as important as the fix.

Depending on individual circumstances, professional advice from an SMSF specialist accountant, adviser or lawyer may be appropriate, particularly where penalties, disqualification or complex rectification are possible.

The bottom line

An auditor contravention report signals that a rule may have been breached and that a reporting threshold was met. It does not, on its own, mean penalties or disqualification will follow. The ATO's published approach ranges from education and rectification through to penalties and disqualification, with outcomes shaped by the seriousness of the breach, whether it has been fixed and the trustees' conduct. Understanding the process may help trustees respond in a measured, informed way.