You're on the board, the year end is approaching, and someone asks a deceptively simple question: “Do we need an audit?” In Australia, that question rarely has a one-line answer. A not-for-profit may face audit or review obligations because of Australian Charities and Not-for-profits Commission registration, state-based rules, its constitution, or the funding agreement sitting in the filing cabinet.
By Panbo Ye, CFP® | FCPA | SSA® | Founder, Everglow
Who this article is for: New charity directors, treasurers, finance managers, and committee members who need a practical view of not for profit audit requirements in Australia.
Table of Contents
- Does Your Not-for-Profit Actually Need an Audit?
- ACNC Reporting Tiers Explained
- Audit Versus Review Versus Independent Examination
- Navigating State and Funding Agreement Rules
- Worked Example: Castle Medical's Community Initiative
- How to Prepare for Your First Audit or Review
- Frequently Asked Questions
Does Your Not-for-Profit Actually Need an Audit?
Usually, the first question isn't “What is the threshold?” but “Which rule applies to us first?” That's the practical reality for Australian not-for-profits. A charity may be below one regulator's reporting trigger and still need external assurance because of a grant agreement, its own governing rules, or state-based obligations tied to its legal structure.
The gap in many discussions about not for profit audit requirements is that they treat audit as a single-number test. In practice, Australian charities operate in a layered system. For the 2023 reporting year, around 59,000 charities lodged an Annual Information Statement, and reporting obligations differ by charity size, which is one reason audit and review needs aren't uniform across the sector (archived commentary noting the ACNC reporting segmentation).
The five checks that matter most
Before a board assumes anything, work through these questions:
- ACNC status: Are you a registered charity, and if so, what reporting tier are you in?
- Legal structure: Are you also an incorporated association or company limited by guarantee with separate obligations?
- Constitution rules: Does your constitution or by-laws require an audit, even if a regulator doesn't?
- Funding terms: Do your grant agreements require an audit, review, or audited acquittal?
- Stakeholder expectations: Have your board, lenders, major donors, or umbrella bodies set a higher assurance standard?
Practical rule: If two different rules point in different directions, the stricter one often becomes the one you must plan around.
A second point often missed is the difference between being legally audited and needing assurance to satisfy governance or funding conditions. Those aren't the same thing. Boards that understand this early usually make better decisions about budgeting, record-keeping, and auditor engagement.
If your reporting framework still relies on ad hoc year-end spreadsheets, it may be worth tightening the underlying reporting approach first, particularly where boards still use special purpose financial reports considerations without fully thinking through who relies on those reports. For broader governance habits, a practical reference point is Everglow's guidance on NFP financial governance best practices.
Takeaway: Most Australian not-for-profits shouldn't start with a revenue guess. They should start with a layered compliance review. That usually answers the audit question faster, and more accurately, than hunting for one magic number.
ACNC Reporting Tiers Explained
For registered charities, the Australian Charities and Not-for-profits Commission is usually the first place to look. The system escalates with size, and charities with annual revenue of $1 million or more generally face stronger reporting obligations. The ACNC reporting regime began after the ACNC was established in 2012, which matters because it brought a more standardised national framework to a sector that had long been fragmented (summary of ACNC audit requirements).
That $1 million point is an important governance dividing line. It doesn't answer every question, but it does tell boards when external assurance expectations usually become more formal.
ACNC size tiers in practice
The table below shows the practical framework boards usually use first when assessing ACNC reporting obligations.
ACNC reporting tiers are commonly used as the starting point for assessing charity financial reporting and assurance needs.
| Charity Size | Annual Revenue | Financial Report Required? | Assurance Required? |
|---|---|---|---|
| Small | Below the medium and large thresholds | Often lighter annual reporting | May depend on other rules |
| Medium | At or above the medium threshold but below large | Annual financial report generally required | Review or audit may apply depending on circumstances |
| Large | $1 million or more is a key milestone for stronger obligations | Annual financial report generally required | Stronger external assurance expectations generally apply |
What boards often get wrong
Boards often focus only on the year-end number. That can be a mistake. Revenue should be monitored through the year because crossing into a higher reporting band changes the preparation burden, not just the filing outcome.
A few habits help:
- Track gross inflows consistently: Don't wait until year end to work out whether grants, donations, and program income have been classified properly.
- Review board papers monthly: Directors should see current revenue against budget and any unusual one-off funding.
- Plan assurance early: If the charity may move into a stronger reporting category, engage before the market becomes crowded.
If you're setting up a new charity and want the structure right from the outset, this guide on how to register a charity in Australia is a useful companion.
A reporting threshold is not just a filing issue. It often changes the standard of evidence your finance team must maintain all year.
Takeaway: For ACNC-registered charities, size matters, and the $1 million milestone matters in particular. But the practical consequence is less about the label and more about whether your systems can support review-grade or audit-grade evidence.
Audit Versus Review Versus Independent Examination
Board members often use these terms interchangeably, but they aren't the same. The difference affects cost, timing, document requests, and how much testing an external practitioner performs.
How they differ
An audit is the most rigorous form of external assurance in this context. It usually involves deeper testing of records, internal controls, balances, approvals, and supporting evidence. If a board needs a high level of confidence, or a funding agreement expressly asks for an audit, this is often the required path.
A review is narrower. The practitioner still examines the financial report, but the work is generally more limited and relies more heavily on inquiry and analytical procedures than full evidentiary testing.
An independent examination can sit at a lower assurance level again, depending on the entity type and the governing rules applying to it. It may suit some smaller bodies, but it's not a universal substitute for an audit or review.
A board-level comparison
- Audit: Highest assurance, most disruption, strongest comfort for funders and boards.
- Review: More moderate assurance, often suitable where the framework allows it.
- Independent examination: Lower assurance, narrower use case, highly dependent on the governing regime.
“Choose the engagement that satisfies the rule you're under, not the one that feels cheapest in the moment.”
Where directors want to understand the underlying assurance mindset more thoroughly, some broad technical learning can help, even if the examples are not Australia-specific. For foundational concepts, UK auditing courses can be useful background reading on how assurance work is structured.
The trade-off is straightforward. Lower-scope engagements may reduce immediate cost and effort, but they don't solve a contractual requirement for a full audit. Boards get into trouble when they commission a review and later discover the grant deed required something stronger. If you need support in scoping the right engagement, audit and compliance advisory can help frame the decision before the year closes.
Takeaway: Audit, review, and independent examination are different tools. The right choice depends first on the rule you must meet, then on the risk profile and expectations of the people relying on the report.
Navigating State and Funding Agreement Rules
A frequent issue for many smaller organisations arises when they assume the ACNC position is the full answer, then discover a state regulator, fundraising condition, or grant contract has imposed a separate assurance requirement.
Why funding agreements change the answer
Australian not-for-profits receiving public funding often face a higher level of assurance where grant conditions or state fundraising laws require an independent audit or review, even when the ACNC itself may not mandate one. Auditors commonly test bank reconciliations, donation deposit integrity, payroll, grant acquittals, minutes, and journal-entry overrides, and transactions should be traceable from source document to general ledger to acquittal report because missing support can lead to qualified findings (nonprofit audit guide reference).
That traceability point matters more than many boards realise. If a grant-funded program manager approves spending by email, the finance team posts the entry, and the acquittal is later prepared from a separate spreadsheet, the organisation may struggle to show a clean evidence trail.
What usually works and what doesn't
What works in practice:
- Single source record-keeping: Keep grant agreements, variations, invoices, approvals, and acquittal support in one controlled location.
- Board minutes with substance: Record approvals clearly. Vague minutes create avoidable audit queries.
- Monthly reconciliations: Don't leave grant reconciliations until acquittal season.
What doesn't work:
- End-of-year reconstruction: Rebuilding support after the fact is expensive and often incomplete.
- Informal restrictions tracking: Restricted funds need disciplined coding, not memory.
- Shared logins or blurred roles: Weak segregation of duties raises the perceived risk quickly.
Some charities also sit inside state-based legal frameworks, such as incorporated association legislation, which may impose their own reporting expectations. The board should read those rules alongside the constitution and each major funding contract. If your organisation needs assistance coordinating those moving parts, Everglow's Audit and Assurance service page outlines the kind of support boards often seek when obligations overlap.
State law may not be the issue that triggers the first problem. The first problem is often a funding deed that asked for evidence the organisation never built.
Takeaway: The hardest audit issues in not-for-profit work usually come from overlap, not from one standalone rule. Boards that map all obligations together are far less likely to be surprised.
Worked Example: Castle Medical's Community Initiative
Castle Medical GP Partnership decides to support local preventive health programs by establishing a separate charitable entity in Castle Hill called the Castle Hill Community Health Initiative. The new charity is enthusiastic, well regarded, and mission-driven. It also has a governance problem to solve early: what level of external assurance does it need?
The facts are straightforward. The entity has annual revenue of $650,000, made up of $400,000 from a NSW Health grant, $150,000 in public donations, and $100,000 from fee-for-service programs. On an ACNC size view alone, the charity may expect a review-level outcome rather than a full audit.
Why the grant changes the answer
The complication is the funding agreement. NSW Health requires a full audit of the entity's financial statements as a condition of the grant. That contractual requirement overrides the board's hope that a lighter engagement would be enough.
This is a common real-world pattern. The core technical trigger for a not-for-profit audit is often the reporting framework plus any state, grant, or governing-document requirements. Once an NFP crosses relevant size tests, the control burden also grows, and weak segregation of duties or undocumented board approvals increase audit risk because the auditor needs sufficient evidence over completeness, valuation, and compliance (audit process background).
What the board should do from day one
For Castle Hill Community Health Initiative, the board should not wait until year end. It should build an audit-ready file from the first month.
- Document grant conditions: Keep the signed agreement, milestones, approved budget, and any variation letters together.
- Separate duties where possible: The person processing payments shouldn't be the same person approving them.
- Approve formally: Major financial decisions, related-party matters, and restricted fund usage should appear clearly in board minutes.
- Close monthly: Reconcile bank accounts, payroll, and grant balances each month.
- Prepare proper statements: Don't rely on management extracts alone. Use disciplined financial statement preparation so the year-end file aligns with the underlying records.
Board lens: The audit requirement didn't arise because the charity did something wrong. It arose because one funding source carried a stricter assurance condition than the base framework.
The practical lesson is simple. The charity's audit answer came from the interaction of ACNC reporting and grant terms, not from either one in isolation.
Takeaway: A medium-sized charity may still need a full audit if a funding agreement requires it. For boards, the safest assumption is that grant money often brings a higher evidence standard with it.
How to Prepare for Your First Audit or Review
The smoothest engagements are built months before fieldwork starts. An audit or review is rarely difficult because of one dramatic issue. It's usually difficult because records, approvals, and reconciliations were left scattered across the year.
What to assemble before year end
Start with the governing documents and evidence trail. Pull together the constitution, board minutes, signed grant agreements, major contracts, bank statements, payroll summaries, asset registers, and any restricted fund schedules.
Then check whether your accounting system can produce clean reports by fund, by program, and by entity. If it can't, fix that before the practitioner arrives. Many boards also use this point to reassess whether their current not-for-profit accounting software is supporting proper coding, approvals, and month-end reporting.
A preparation approach that usually works
- Engage early: Independence and scope should be confirmed well before filing deadlines.
- Build a board pack: Minutes, resolutions, conflict declarations, and key policies should be complete and easy to locate.
- Test your own controls: Follow one donation, one grant payment, and one payroll cycle from source to ledger to report.
- Clear suspense items: Unexplained balances and unreconciled accounts create avoidable queries.
A first-year board should also ask the practitioner what the prepared-by-client list will likely include. That simple conversation reduces scramble later. If a board wants specific guidance on sequencing that work, the most efficient step is usually to ask for advice before year end rather than after the draft reports are already late.
Takeaway: Good audit preparation is ordinary governance done consistently. If records are current, approvals are documented, and reconciliations are timely, the engagement becomes far less disruptive.
Frequently Asked Questions
How much does an audit or review cost?
Cost depends on the entity's size, complexity, funding conditions, and the quality of its records. A simple review and a grant-heavy audit are very different exercises. Boards should compare scope carefully, not just fees, because the cheapest quote may exclude work your funding agreement requires.
What happens if we miss an ACNC deadline?
The organisation may face follow-up from the regulator and added governance pressure internally. A late filing can also signal broader record-keeping problems. If delay is likely, directors should address it early and make sure the reason, remediation, and communication are documented.
Can our bookkeeper perform the review or audit?
No. Independence is fundamental. The person who prepares the books shouldn't be the same person providing external assurance over them. Even where a trusted internal finance person is highly capable, the engagement must still be carried out by an appropriately independent and qualified practitioner.
Our constitution says we need an audit, but the regulator seems lighter. Which one applies?
The constitution matters. If the governing document requires an audit, the board should treat that as binding until it is properly amended. This is one of the clearest examples of why not for profit audit requirements are layered rather than controlled by one threshold alone.
Do we need to think about data handling during an audit?
Yes. Audit readiness isn't only about numbers. It also involves secure document sharing, access controls, and disciplined handling of donor, payroll, and beneficiary information. For boards thinking about broader control maturity, material on data protection for CEFs can be a useful prompt for governance discussions around evidence security and assurance workflows.
Is a review always enough for a medium charity?
Not always. A review may be the base expectation under one framework, but a grant agreement, state rule, or constitution may push the organisation into a full audit. The board should always confirm the strictest applicable requirement before engaging the external practitioner.
If you would like clarity on how these principles may apply to your own circumstances, contact Everglow on 1300 913 929 or email contact@everglow.au. To book directly: Book a meeting with Panbo. You can also learn more about Everglow Prosperity and the firm's accounting, advisory, audit, and not-for-profit support services.
English
Chinese (Hong Kong)
Chinese (China)
Greek
Hebrew
Vietnamese
Arabic