Audit office damns ATO safeguards in wake of $2bn GST fraud

The Australian National Audit Office has damned the ATO’s processes for assessing GST fraud risk as “not fit for purpose” nor operating as intended and says it lacks procedures to respond to a “large-scale fraud event” after $2 billion went missing in 2022–23.

The ANAO investigation, set up after a “significant increase in attempts to obtain false GST refunds” during 2021–22, also found the ATO’s fraud prevention strategies, management and reporting of incidents were only “partly effective” and made five recommendations for improvements.

These included that the ATO “should develop and implement a response for large-scale fraud events that do not meet the criteria specified in the extant Integrity Incident Response Framework” with the ability to detect early warning signs of fraud across the tax office, clear allocation of decision-making authority and actions to prevent and recover losses.

“The lack of clarity for roles and responsibilities, inadequate implementation of assurance requirements, and absence of a holistic and contemporary view of GST fraud risks undermines the effectiveness of efforts to prevent, detect and respond to fraud events in a timely manner and minimise fraud losses,” the ANAO report said.

“The ATO has implemented partly effective strategies to prevent GST fraud. The ATO has established an enterprise framework for fraud, but it is not fit for purpose and is not operating as intended.”

The ANAO was asked to report after the ATO became aware of widespread GST fraud in December 2021 and responded by setting up Operation Protego in April 2022 in conjunction with the Serious Financial Crime Taskforce.

The ANAO set three criteria to assess the ATO’s management and oversight of GST fraud control arrangements:

• Has the ATO implemented effective strategies to prevent GST fraud?
• Has the ATO effectively implemented strategies to detect and respond to GST fraud?
• Has the ATO implemented effective arrangements to oversee, monitor and report on fraud control arrangements for the administration of GST?

The report found GST receipts had increased 68 per cent over the decade to 2022–23 with $81.4 billion collected and an additional $6.1 billion in liabilities raised from the processing of 11.2 million BAS.

The ATO said its Operation Protego had pursued more than 57,000 perpetrators of GST fraud and by the end of August last year, criminal investigations resulted in more than 100 arrests and 16 convictions.

However, the ANAO cited a report by the ATO’s chief internal auditor which highlighted shortcomings exposed by Operation Protego, which found the office “could experience a large-scale fraud event at any time” and said it should have been ready to respond rather than reacting to events.

Operation Protego found $2 billion in total liabilities from April 2022 to June 2023, with fake GST refund claims ranging from $8,100 to $32.3 million. It said the ATO had stopped $2.7 billion in suspect refunds before payment and had investigated 150 of its officers suspected of being involved, resulting in terminations and criminal investigations.

Operation Protego was closed on 3 November 2023 to new cases and the ANAO said the ATO had not quantified the administration cost of the operation.

However, it said the ATO had made improvements during the audit, including reviewing responsibility for managing fraud risk, developing processes to ensure all its business lines were examined for fraud conformance, reviewing its training material, better handling of tip-off data, and updating its internal fraud investigation procedures.

The ATO accepted all five recommendations, which included:

• The ATO should finalise work on clarifying roles and responsibilities for fraud prevention, detection and treatment.
• “The ATO should conduct and document assessments of its GST fraud risks regularly and ensure that it has a contemporary and holistic view of its GST fraud risks.”
• As part of its response to large-scale fraud events it should develop the ability to monitor early warning signs including tip-offs; identify escalation triggers and how it will respond; clearly allocate authority for decisions; prioritise prevention, containment and recovery; and establish criteria for evaluating its fraud response and an ability to change the framework when required.
• The ATO should consider an alternative benchmark for fraud indicators – “the benchmark used in the dashboard reporting is not fit for purpose as it is a measure of fraud and error government payments” – and abandon inaccurate references to an Attorney-General Department “fraud benchmark”.