Email Archiving for Accountants: What the ATO Actually Expects

Under section 262A of the Income Tax Assessment Act 1936, most Australian taxpayers — and the tax agents acting for them — must retain records explaining transactions and positions for five years. For registered tax agents and BAS agents, the Tax Practitioners Board expects those records to include the correspondence that shows how advice was given and why, not just the final return. If that correspondence lived in email, and the staff member who sent it left eighteen months ago, "we'll find it" is not a plan.

Picture the scenario: a client's CGT position from a 2022 property sale gets queried in 2026. The ATO wants to see the advice trail — what the client was told about the main residence exemption, what documents they provided, whether the firm flagged a risk they later ignored. The accountant who handled it left the practice a year ago. Their mailbox was archived to a PST file that nobody can open without IT tracking down the original Outlook profile. The client folder on the shared drive has the final invoice and the lodged return, but none of the emails that explain the reasoning. This is not a hypothetical — it's the single most common gap firms discover when a matter actually gets tested.

What the retention rule actually requires

Section 262A requires records sufficient to explain all transactions relevant to a taxpayer's tax position, kept for five years from when the transaction or act occurred — or, for records tied to an asset like property or shares, five years from the relevant CGT event (usually disposal). That means a client's property purchase correspondence from 2019 might need to survive not five years, but five years past whenever they eventually sell.

On top of the ITAA obligation, the Tax Practitioners Board's Code of Professional Conduct under the Tax Agent Services Act 2009 requires registered agents to act with competence and to maintain the records that demonstrate compliance with the Code — including the advice given to clients and the basis for it. In a TPB investigation or an ATO audit, the practical question is rarely "did you lodge correctly." It's "can you show your working," and for a professional services firm, the working is largely in the email trail: engagement letters, clarifying questions, advice given, changes the client requested, sign-offs.

Penalty exposure isn't limited to fines. A firm that can't produce the correspondence behind a position it took risks the ATO disallowing the position outright, and a firm that can't produce records for a TPB conduct review risks its registration. For a two-partner practice, either outcome is existential in a way a compliance line item never looks like on paper.

What most small firms actually do

Almost every firm we talk to says some version of "it's all in Outlook" or "we keep everything, nothing gets deleted." In practice, that means email sits in individual mailboxes, subject to whatever retention policy Microsoft 365 defaults to, whatever the mailbox size limit forces staff to clean up, and whatever happens when someone leaves and IT decommissions their account. Sent items live in a different place from received items. Nothing is indexed by client or matter. When someone finally needs to search for "everything related to the Smith Family Trust between 2021 and 2023," it becomes a manual, mailbox-by-mailbox exercise that takes days and still might miss something — particularly anything the departed accountant deleted before they left.

This works fine until it doesn't. It fails at exactly the moment it matters most: an audit, a dispute, a professional indemnity claim, or a TPB inquiry, none of which arrive on a convenient timeline.

What good looks like

A defensible email archive for an accounting practice has a few concrete characteristics, and none of them require reinventing your workflow.

Continuous, automatic capture. Every message — sent and received — is copied to the archive at the moment it moves, independent of what happens to the original mailbox afterwards. If a staff member deletes an email or leaves the firm, the archive copy is unaffected.

Tamper-evident storage. Once archived, a message can't be edited or backdated. If a regulator or opposing party ever questions authenticity, the firm needs to show the record hasn't been altered since capture — not just that it exists.

Full metadata preserved. Sender, recipient, timestamps, and headers intact — not a forwarded copy or a screenshot, which strips the information that proves when something was actually sent.

Retrieval measured in minutes, not days. Searchable by client, date range, sender, or keyword, so producing everything related to a matter for an ATO request doesn't become a week-long fire drill across five former employees' mailboxes.

Coverage that survives staff turnover. The archive doesn't depend on an individual's mailbox staying intact. When someone leaves, their correspondence history stays retrievable under the client, not locked in an account that gets deactivated.

This is the actual gap between "we keep everything in Outlook" and a defensible archive: Outlook keeps messages until something — a mailbox limit, an offboarding, a "clean up your inbox" email from IT — causes them to disappear, and nothing tells you when that happens. An archive is built specifically so nothing depends on those decisions.

The practical path forward

Start by identifying what you're actually exposed on: client correspondence tied to lodged positions, engagement letters, and advice trails for anything involving an asset likely to trigger a future CGT event. That's a 30-minute conversation with your practice manager, not a project.

Next, check what happens today when a staff member leaves — does their mailbox get archived somewhere searchable, or does it just get deactivated? If it's the latter, that's your most urgent fix, because it's the scenario most likely to bite you within the next year.

Then move to continuous capture rather than relying on individual mailbox retention. This is where tools like AutoArchive Mail come in — it captures every inbound and outbound message automatically, stores it in a tamper-evident archive independent of the live mailbox, and makes it searchable by client or date range, so a request for "everything from the Henderson matter, 2021 to now" is a search, not an archaeology project. You can see how it's set up and pricing tiers for firm size via Start Free Trial.

If your firm has a live TPB matter, a pending dispute, or client files with complex CGT exposure going back years, that's the point to bring in your professional indemnity insurer or a lawyer familiar with TPB conduct proceedings — email archiving fixes the record-keeping gap, not the underlying advice risk.

One thing this doesn't cover

This article addresses ATO and TPB record-keeping obligations specifically. If your practice also provides services covered by AUSTRAC's AML/CTF regime — for example, certain trust and company structuring services — you have separate retention obligations under different legislation, and they're worth checking with a specialist rather than assuming your tax record-keeping covers them too.

← Back to all articles