CPE record-keeping for tax practitioners - what survives a TPB audit

Nobody loses their tax agent or BAS agent registration because they didn't do enough CPE. They lose it because they can't prove what they did. A short guide to what the TPB actually expects in your CPE log, what counts, and why the five-year retention rule matters more than the hours.

Cover Image for CPE record-keeping for tax practitioners - what survives a TPB audit

Most tax and BAS agents I talk to know the headline CPE numbers - 20 hours per year minimum, 120 hours over three years for tax agents, 90 over three years for BAS agents. That part's been steady since the policy was last refreshed on 1 July 2022 and it's generally well understood.

The bit that catches people out is the evidence side, not the hours side. I've seen plenty of practitioners who definitely did the work and genuinely can't produce the records when asked. That's the gap worth closing.

The basic obligations

Briefly, then I'll get into the practical bits:

  • 20 hours minimum per year - a floor, not a target
  • 120 hours over a 3-year period for tax agents, 90 hours for BAS agents
  • 5-year record retention - reduced from 6 a while back, but still a real obligation
  • Maximum 25% from technical/professional reading - so reading the ATO updates counts, but only so much of it
  • Up to 10% from health and wellbeing activities - a fairly new addition and surprisingly often missed

Your CPE period is the 3 years from your registration date, unless you're a member of a recognised professional association and you've elected to align with theirs. Aligning with a body like CA ANZ, CPA Australia or IPA tends to make the admin simpler because their CPE cycle drives the same record-keeping anyway.

What the TPB actually asks for in a compliance review

Not all CPE records are equal in the TPB's view. A spreadsheet that says "attended webinar - 1 hour - 12 March 2025" is technically a record, but it's the weakest possible version of one. What survives proper scrutiny:

  • Date and duration of the activity
  • Topic or title that's specific enough to identify what was covered
  • Provider or source - who ran the session, who wrote the article
  • Evidence of completion - certificates, attendance confirmations, screenshots of the completed module
  • Relevance to your registration - a one-line note on why the activity counts as CPE for your specific services

That last one is the one most logs don't bother with. The TPB doesn't expect an essay, but it does expect you to be able to articulate why your CPE is relevant to your registration type and the services you provide. A BAS agent counting estate planning webinars is going to struggle to defend that count.

The unglamorous truth about record loss

Most CPE record loss isn't dramatic. It's:

  • Certificates that lived in an inbox until the inbox got archived
  • A spreadsheet that was kept up to date for the first year then drifted
  • Activities completed under one provider whose website was decommissioned (so no certificate retrieval)
  • Records on a personal laptop that's since been replaced

None of these are unusual. None of them are defensible at audit. The 5-year retention rule means the activity you completed in May 2026 needs to still be evidentiable in May 2031, which is a long time for a spreadsheet on someone's desktop to survive.

What actually works

A few practical things I've watched work, in roughly increasing order of robustness:

  1. A single place for certificates - a shared drive folder named by year, with a flat list of PDFs. Better than nothing, falls apart at staff turnover.
  2. A CPE log spreadsheet with running totals - works for a couple of years, typically drifts on the third year just as the cycle resets
  3. A CPE module in your practice management system - certificates uploaded against the staff record, totals computed against the registration anniversary, reminders before the rolling totals dip

The third one is what we built into myQMS - certificates attached to the user record, automatic totals against each person's CPE cycle, and a warning when someone's tracking light on hours for the period. It's not the only way to do it (a well-disciplined spreadsheet works fine for sole practitioners), but for any practice with more than two registered agents the spreadsheet approach tends to drift faster than you'd think.

So that's basically where we're at with the practical side. The headline obligations are well-published and easy to find on tpb.gov.au. The evidence side - what your log actually looks like when someone asks for it - is where I'd spend the time, because that's the part that decides whether your registration survives a review.

Happy to talk through what your current CPE setup looks like if you'd like a second opinion - no obligation either way.