The auditor as gatekeeper
SMSF auditors are responsible for providing assurance over the $1 trillion in retirement savings held in Australia’s 661,000 SMSF accounts, and ASIC says they must act as trusted gatekeepers. A fraudster who gets through your audit has got through the last check.
That does not make you a detective. It means that when your evidence does not fit your understanding of the fund, you stop and ask.
Remember
- Auditors are described as trusted gatekeepers.
- The numbers are large; the trust is too.
- When evidence does not fit, stop and ask.
Facts and sources for this part
- SMSF auditors are responsible for providing assurance over the $1 trillion in retirement savings held in Australia’s 661,000 SMSF accounts, and ASIC says they must act as trusted gatekeepers. [S12]
What ASIC says of other gatekeepers
ASIC says superannuation trustees are the gatekeepers of their members’ money and cannot outsource their obligations to third parties when it comes to protecting members from scams. Its review of 15 superannuation trustees found none had an organisation-wide scams strategy in place.
That letter is aimed at trustees of regulated funds, not SMSF auditors. It is still a useful picture of what a regulator expects: a plan, a strategy and a duty that cannot be handed to someone else.
Remember
- Gatekeepers cannot outsource their duty to protect members.
- Regulators expect a scam plan, not just good intentions.
- Apply the same idea to your practice.
Facts and sources for this part
What the ATO will not do
The ATO says it is not responsible for compensating victims of scams or resolving disputes between trustees. A victim who hopes the regulator will make them whole is likely to be disappointed.
Our advice: tell trustees this plainly at the start of an engagement. Prevention is the main protection, and it depends on checks the trustee does before the money moves.
Remember
- The regulator does not compensate scam victims.
- Prevention is the main protection.
- Say so to trustees early.
Facts and sources for this part
- The ATO says the regulator is not responsible for compensating victims of scams or resolving disputes between trustees. [S6]
When auditors miss it
In the first half of the 2025-26 financial year ASIC cancelled, conditioned or disqualified 28 SMSF auditors after finding breaches such as failing to comply with auditing and assurance standards, independence and continuing professional development requirements, or to hold professional indemnity insurance. The ATO monitors SMSF auditor compliance and ASIC investigates what the ATO refers.
None of those cases is about a trustee being scammed, but the lesson carries across: standards, evidence and records are what protect an auditor when something goes wrong.
Remember
- Breaches include evidence, independence, CPD and insurance.
- The ATO refers; ASIC investigates.
- Records protect you.
Facts and sources for this part
- In the first half of the 2025-26 financial year ASIC cancelled, conditioned or disqualified 28 SMSF auditors, after finding breaches that included failing to meet continuing professional development requirements. [S12]
- ASIC lists completing the prescribed ongoing professional development among an SMSF auditor’s statutory obligations, and says the ATO monitors SMSF auditor compliance. [S2]
A routine that fits a busy practice
Our advice: at the start of each engagement, ask four questions. Who set this fund up, and who holds the bank login? Where did the money come from? Does any document need confirming at source? Has any contact detail changed in the past year?
Our advice: keep a short note of the answers on every file. If a fund fails more than one of the four, escalate inside your firm before you sign. If you hold clients’ tax or super data, make sure everyone in your firm knows to ring the ATO’s Client Identity Support Centre if they suspect a breach.
Remember
- Four questions at the start of every engagement.
- More than one fail means escalate before signing.
- Everyone should know who to call about a suspected breach.
Facts and sources for this part
- The ATO says you must report all tax-related security issues to it, and that anyone holding tax or superannuation data (including TFNs) for clients who suspects a breach should phone its Client Identity Support Centre. [S7]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
What does ASIC say about the duty of superannuation trustees to protect members from scams?
Show the answer
Right answer: A, It cannot be outsourced to third parties. Trustees are the gatekeepers of their members’ money and cannot outsource their obligations to third parties. [S11]
Question 2 of 3
In the first half of 2025-26, how many SMSF auditors had registrations cancelled, conditions imposed or were disqualified?
Show the answer
Right answer: A, 28. ASIC cancelled, conditioned or disqualified 28 SMSF auditors in the first half of the 2025-26 financial year. [S12]
Question 3 of 3
About how much in retirement savings do SMSF auditors give assurance over, according to ASIC?
Show the answer
Right answer: C, $1 trillion. SMSF auditors are responsible for providing assurance over the $1 trillion in retirement savings held in Australia’s SMSF accounts. [S12]