Australian businesses are legally required to keep their financial records — and to be able to produce them if asked. The general rule is five years, but the starting point and the format requirements trip people up. Here is what the ATO actually expects.
- Most business records must be kept for at least five years.
- The five years often runs from when a record is prepared, obtained or a transaction completed — and longer in some cases.
- Records must be in English (or easily convertible) and be readily accessible.
- A reliable backup is how you ensure records survive and remain retrievable.
The general five-year rule
As a general rule, the ATO requires businesses to keep records that explain their transactions and tax position for at least five years. This covers income and expenses, GST, payments to employees, and the documents that substantiate them — invoices, receipts, bank statements and the like.
When the clock starts
The five years is not always from the end of the financial year. Depending on the record, it may run from when the record was prepared or obtained, or from when the relevant transaction or act was completed — whichever is later. Some situations extend the period: for example, records relating to assets for capital gains tax, or where there is a dispute, may need to be kept considerably longer.
Format and accessibility
Records can be kept electronically, which suits cloud accounting perfectly. But the ATO expects them to be:
- In English, or in a form that can be readily converted to English.
- Not altered or manipulated, and protected from damage.
- Readily accessible — you must be able to produce them when required.
That last point is the one businesses underestimate. "We had it, but it is gone" is not a defence.
Where backups fit
If your records live solely in a cloud platform, your ability to meet these obligations depends on continued access to that platform — and, as we have covered, keeping a recoverable copy is your responsibility, not the provider’s. A cancelled subscription, a deletion or a compromised account can leave you unable to produce records you are legally required to hold.
Meeting the obligation cleanly
An independent backup with multi-year retention is the practical answer: it keeps your records intact, tamper-evident and retrievable for the full period, independent of your live subscription. With immutable retention, you can also demonstrate the records have not been altered — exactly what the ATO’s format requirements call for.