When owners think about preparing a business for sale, they usually start with the numbers.
Revenue, profit, margins, customer concentration and growth receive plenty of attention. Legal and regulatory compliance can be easier to overlook, particularly when the business has operated successfully for many years without any obvious problems. But a buyer will look at the business differently.
They are not only asking how much money the business makes. They also want to know what liabilities they could be inheriting.
Are employees being paid correctly? Is superannuation up to date? Have BAS obligations been met? Are the company's directors complying with their duties? Are customer contracts enforceable? Does the business comply with Australian Consumer Law? Are licences current? Are there privacy, workplace safety, tax or regulatory problems sitting beneath the surface? All of these questions are part of a buyer's risk management.
One unresolved compliance issue can quickly become a major part of a transaction. A problem discovered during due diligence may result in the buyer seeking a lower price, requesting money to be retained after settlement, insisting on additional warranties or indemnities, changing the structure of the transaction, or walking away altogether.
That is why legal and regulatory exposure should be reviewed before the business reaches the market, not after a buyer discovers the problem.
There is no single compliance checklist that applies perfectly to every Australian business. A construction company faces different obligations from an ecommerce retailer. A medical practice is different from a manufacturer. A transport business is different from a software company.
However, there are several areas that almost every Australian business owner should review when preparing for a sale.
If the business operates through a company, the directors have legal duties that are separate from their responsibilities as shareholders, employees or founders.
Directors are expected to understand what the company is doing, remain informed about its financial position, exercise care and diligence, act in good faith in the company's interests and use their position and information appropriately.
One of the most important areas is solvency. A company can be profitable on paper and still experience serious cash flow problems. Directors need to understand whether the company can pay its debts as and when they fall due.
Warning signs can include:
If directors suspect the company may be approaching insolvency, the issue should be taken seriously and professional advice obtained promptly.
Australia does have safe harbour provisions that can potentially protect directors from civil insolvent trading liability in certain circumstances while they develop and pursue a course of action reasonably likely to lead to a better outcome for the company. However, this is an area where specific legal and insolvency advice is important.
One reason people operate through companies is the separation between the company and its owners.
That protection is important, but it is not absolute.
There are circumstances in Australia where directors can face personal exposure.
Examples can include:
This becomes particularly relevant when reviewing the business before sale.
Directors should understand which obligations belong to the company and which could potentially follow them personally.
Australian directors should pay particular attention to unpaid PAYG withholding, GST and super guarantee charge obligations.
Under the ATO's director penalty regime, directors can become personally liable for certain unpaid company tax and super liabilities.
This means that failing to deal with these obligations is not simply a problem that can always be left inside the company.
Before selling, directors should obtain a clear picture of:
If there are problems, deal with them early.
A buyer discovering overdue statutory liabilities during due diligence will immediately begin asking what else has been missed.
For most established Australian businesses, BAS compliance is one of the first financial housekeeping areas to review.
Depending on the business, the BAS may report obligations including GST, PAYG withholding and PAYG instalments.
GST reporting frequency depends on the circumstances of the business. Businesses with GST turnover of $20 million or more generally report monthly, while many businesses below that level report quarterly unless another arrangement applies.
Standard quarterly BAS due dates are generally:
Monthly BAS lodgement and payment is generally due on the 21st day of the following month. Different extensions may apply in some circumstances, including where registered agents are used, so businesses should work to the due dates issued by the ATO for their particular obligations.
The important point for a seller is simple: do not go into due diligence with several missing BAS lodgements and expect a buyer not to notice.
Most Australian businesses must register for GST once their GST turnover reaches the applicable registration threshold.
For most businesses that threshold is $75,000. For non-profit organisations it is generally $150,000.
A growing business that crossed the registration threshold but failed to deal with GST correctly can create a historical liability.
Similarly, businesses operating across several entities should make sure transactions, invoicing and GST reporting are occurring through the correct entity.
This becomes particularly important where the business structure has changed over time.
Employers generally need to withhold tax from salary and wage payments and report and pay those amounts to the ATO.
PAYG withholding can also apply to some other payments, including payments to company directors and office holders.
As part of a compliance review, check that:
Do not assume that because payroll software generated a number, the number must be correct.
The systems are only as accurate as the information and settings being entered into them.
Single Touch Payroll, commonly known as STP, requires employers to report payroll information to the ATO through STP-enabled software when employees are paid. For an established business, payroll records, STP reporting and accounting records should tell the same story.
Differences between them can create unnecessary questions during due diligence.
Review:
Payroll is one of those areas where small mistakes can accumulate into large amounts when they continue across many employees and several years.
Australian employers need to pay particular attention to the Payday Super reforms that commenced on 1 July 2026. Superannuation is no longer simply something that can be treated as a quarterly administration exercise.
Under Payday Super, employers are required to pay super guarantee in connection with payday. As a general rule, the contribution needs to reach the employee's super fund within the applicable timeframe, which is generally within seven business days of payday, subject to exceptions.
The super guarantee rate is currently 12 percent.
Businesses should make sure payroll and payment systems have been updated for the new rules.
Review:
The old Small Business Superannuation Clearing House closed from 1 July 2026, so businesses that previously relied on it should already have moved to an alternative compliant payment method.
One of the most dangerous habits a struggling business can develop is using employee superannuation as temporary working capital.
The reasoning can sound harmless: cash is tight this month, so super will be caught up when a large customer pays.
The problem is that this can quickly compound.
The business may incur additional liabilities, the ATO may become involved, and directors can face personal exposure through the director penalty regime.
From a buyer's perspective, unpaid super is also a serious warning sign because it may indicate broader cash flow, advisory or governance problems.
Employment compliance is another area where historical liabilities can build quietly. Many Australian employees are covered by modern awards that set minimum pay rates and conditions based on industry, occupation and classification. Do not assume that paying an employee a salary automatically means the business has satisfied all award obligations.
Review whether employees have been correctly classified and whether their remuneration properly accounts for applicable:
Minimum wages and award rates can change each year, so payroll settings should be reviewed rather than allowed to roll forward indefinitely.
The National Employment Standards, commonly known as the NES, set minimum employment entitlements for employees in Australia's national workplace relations system.
Contracts and awards cannot simply remove those minimum rights.
Owners should review whether employment practices comply with applicable entitlements covering areas such as leave, working arrangements, public holidays, notice and other minimum standards.
If the company has grown quickly, acquired another business, or inherited old employment arrangements, it can be worth having the workforce structure reviewed before sale.
This is an area Australian employers should take particularly seriously.
Since 1 January 2025, intentionally underpaying wages or employee entitlements can amount to a criminal offence under federal workplace laws.
The offence is directed at intentional conduct rather than honest mistakes, but the change makes payroll governance even more important.
Businesses should have processes to:
Payroll should not depend on one employee quietly using the same spreadsheet they have used for the last decade without anyone reviewing whether the rules have changed.
Australian employers also have specific record-keeping obligations. Employee records generally need to be retained for seven years and must contain prescribed information. Pay slips generally need to be provided within one working day of payday.
Before selling, review whether the business has reliable records covering:
During due diligence, poor employment records can make it difficult for a buyer to determine whether hidden employee liabilities exist.
If your business sells goods or services, the Australian Consumer Law should form part of your compliance review. One of the most important principles is that businesses must not engage in misleading or deceptive conduct.
This extends well beyond traditional advertising.
Statements made through websites, salespeople, quotes, packaging, social media, product descriptions, testimonials and promotional campaigns can all create legal risk if they give customers a misleading impression.
Review claims about:
A claim does not become safe simply because the business did not intend to mislead.
If your marketing team makes strong claims, make sure the business can substantiate them.
Businesses cannot simply write their own refund policy and assume it overrides Australian Consumer Law.
Consumer guarantees apply automatically to many goods and services.
For example, products generally need to be of acceptable quality, fit for their intended purpose where applicable and match relevant descriptions. Services are also subject to statutory guarantees.
A sign stating "No refunds" does not remove rights provided by law. This area is relevant beyond traditional retail consumers. In some circumstances a business purchasing goods or services can itself qualify as a consumer under the Australian Consumer Law.
For many business purchases, consumer guarantees can apply where the price is below $100,000 including GST, subject to the relevant rules and exceptions.
If the company has warranty terms, refund policies or standard customer responses that have not been legally reviewed for years, consider reviewing them before sale.
Standard contracts are another important area.
Since November 2023, Australia has prohibited businesses from proposing, using or relying on unfair terms in standard form contracts covered by the legislation, with penalties available for breaches.
The protections can extend to qualifying small business contracts as well as consumer contracts. Under the current small business test for these protections, coverage can apply where a business has fewer than 100 employees or annual turnover below $10 million, subject to the other requirements of the legislation.
Potential problem clauses can include terms that create a substantial imbalance between the parties, particularly where they give one party broad rights that are not reasonably necessary to protect legitimate interests.
Do not assume that because a contract template has been used for ten years it remains appropriate today.
If the business uses subscriptions, maintenance contracts, memberships or other recurring billing arrangements, review how renewals and cancellations actually work.
The commercial goal may be to make customer retention easy, but renewal structures, representations and contract terms still need to comply with Australian Consumer Law and other applicable requirements.
Look at whether:
Recurring revenue is valuable to a buyer, but not if that revenue depends on practices that create regulatory exposure.
Customer information has become an increasingly important business asset, but holding that data creates responsibilities as well.
The Privacy Act applies to many Australian businesses, including generally businesses with annual turnover above $3 million, as well as some businesses below that threshold because of the nature of their activities. Some smaller businesses may still be covered because they handle particular types of information or operate in particular industries.
Businesses should understand:
A due diligence process may itself involve sharing information with prospective buyers, so sellers should also consider how personal and confidential information is handled within the transaction.
Businesses covered by the Privacy Act may also have obligations under the Notifiable Data Breaches scheme. An eligible data breach can require notification to affected individuals and the Office of the Australian Information Commissioner where the relevant legal tests are met, including where serious harm is likely.
Do not wait for a cyberattack to work out who is responsible for responding.
A basic incident response plan should identify:
Workplace safety is another area where responsibilities can extend beyond the company itself.
Australian work health and safety requirements operate through Commonwealth, state and territory laws, so businesses need to understand the specific laws applying in each jurisdiction where they operate.
Under the WHS framework used across much of Australia, a person conducting a business or undertaking, commonly called a PCBU, has primary health and safety duties.
Officers can also have a personal duty to exercise due diligence to ensure the organisation complies with its WHS obligations. This means directors and senior decision-makers should not simply assume that safety has been delegated to the Operations Manager.
They should understand the major hazards, make sure appropriate resources and systems are available, and monitor whether those systems are actually working.
A buyer is unlikely to be impressed by a pristine safety manual if the procedures in it bear no resemblance to what staff actually do.
Review practical evidence such as:
Good compliance is demonstrated through actual behaviour and records, not simply policies sitting in a folder.
Some businesses cannot legally operate without particular licences, permits or registrations. Depending on the industry, these could relate to:
Check not only that the licence exists, but whose name it is held in.
A business may appear fully licensed only to discover that an important approval is actually held personally by the owner or one employee who intends to leave after settlement.
That can become a significant transaction issue.
The fact that the business has a licence today does not necessarily mean the purchaser automatically receives it tomorrow. Some licences attach to the company. Others attach to particular individuals, premises, activities or legal entities.
Before going to market, understand:
Discovering three days before settlement that the purchaser cannot legally operate the business is a problem that should have been identified much earlier.
Contracts often become far more important during a sale than they seemed during normal operations.
Review significant agreements for:
A seller may describe a major customer as "locked in for another five years", only for the buyer's lawyer to discover that the customer can terminate the agreement with 30 days notice.
Know what your contracts actually say before making claims about them.
Personal guarantees can easily be forgotten because they may have been signed many years earlier.
The owner may have guaranteed:
Selling the shares or business does not necessarily release a guarantor automatically. Make sure there is a deliberate process for identifying guarantees and obtaining releases where required as part of the transaction.
Especially since the changes introduced during the 2026 federal budget tax reform, knowing which entity owns intellectual property is essential. A business may have a valuable brand, website, software platform, design library, product drawings, photographs, customer database or proprietary processes.
But does the business legally own them?
Problems can arise where:
These problems are usually much easier to fix before buyers start asking questions.
Over time, businesses often become more complicated. One company owns the equipment. Another owns intellectual property. A family trust owns the shares. A related entity employs staff. Loans move between companies. There may be perfectly legitimate reasons for this structure, but a buyer needs to understand exactly what they are acquiring.
Prepare a clear organizational structure chart showing:
The more complicated the structure, the more important it is to involve experienced legal, accounting and tax advisors early.
Something as simple as outdated corporate records can create unnecessary friction.
Review whether ASIC records accurately reflect:
Make sure directors who require director identification numbers have complied with applicable requirements. If there are discrepancies between company records and what management believes the structure to be, resolve them before due diligence.
The ATO generally requires businesses to keep many tax and super records for at least five years, although some records have different or longer requirements. Do not rely on the accountant being the only person who knows where records are located.
The business should have an organised system for retaining information supporting:
Good records are valuable not only for compliance. They also make buyer due diligence much faster.
Create a list of current and historical regulatory matters.
This could include correspondence from:
An old enquiry that was resolved may be relatively unimportant. An unresolved investigation is different. The important thing is to know what exists and obtain advice about what needs to be disclosed to a purchaser.
Not every legal exposure begins with a regulator.
Review:
Consider whether there are disputes that have not yet become formal claims but could reasonably develop into one. A buyer generally prefers to hear about a problem from the seller rather than discover it independently.
Many compliance problems do not occur because someone deliberately broke the law. They occur because nobody owned the deadline.
A compliance calendar can track items such as:
Assign each obligation to a particular person rather than simply to "accounts" or "management".
When everyone is responsible, nobody is responsible.
A good accountant, lawyer, payroll specialist or compliance advisor can be extremely valuable. But outsourcing a function does not necessarily mean management can stop paying attention to it. Directors should still ask questions.
For example:
Professional advisors are there to help the business manage its obligations. They should not be treated as a substitute for governance.
If you intend to sell, start preparing the information a buyer is likely to request. Your legal and compliance folder may include:
Do not simply dump thousands of documents into a folder.
Organise them so the buyer and their advisors can understand the business.
No established business is completely perfect. A compliance review may identify an old employment agreement, a missing IP assignment, an underpayment, an expired licence, a BAS discrepancy or a contract that needs updating.
The important question is what happens next. If the problem can be corrected before sale, deal with it. If it cannot be completely eliminated, quantify it, obtain advice, document what has been done and prepare to explain it honestly.
There is a major difference between telling a buyer:
"We identified a payroll issue last year, engaged a specialist, calculated the historical amount, repaid affected employees and changed our payroll controls."
and allowing the buyer's accountant to discover the problem unexpectedly.
The first suggests management and control.
The second creates suspicion.
Compliance does not usually generate revenue directly, so owners sometimes view it purely as a cost. Buyers see it differently.
Legal uncertainty can affect how much they are prepared to pay because it changes the risk attached to future earnings.
A buyer may discount value where they see:
Alternatively, the purchaser may agree to the headline price but require protections through warranties, indemnities, deferred payments or retention amounts.
Cleaning up these areas before sale can therefore have a direct commercial benefit.
The worst time to discover a legal problem is after a buyer has spent weeks investigating the business and is preparing to sign a contract.
At that point, the seller has less control. The buyer may already have become nervous. Lawyers may recommend additional protections. The transaction timetable may be delayed and negotiating leverage can shift toward the purchaser.
A better approach is to conduct your own review before going to market.
Think of it as performing due diligence on your own business before asking someone else to do it.
You are looking for the questions that a sensible purchaser, accountant or lawyer is likely to ask, and making sure you know the answers first.
Australian businesses operate within a complex framework of corporate, taxation, employment, consumer, privacy, workplace safety and industry-specific laws.
No business owner needs to become an expert in every one of them. But owners and directors do need systems that ensure the right questions are being asked and that important obligations are not being ignored.
For a seller, the objective is not to present a business that has never experienced a compliance problem. The objective is to present a business that understands its obligations, identifies problems early, seeks appropriate advice, keeps good records and fixes issues when they arise.
That tells a buyer something important about the quality of the organisation they are acquiring. A business with clean legal and regulatory foundations is easier to investigate, easier to transfer and easier for a buyer to trust. The best time to identify an exposure is while you still have the time and control to fix it, not when it appears in a buyer's due diligence report.
