Business & Back-Office Glossary

Plain-English definitions of 108 finance, payroll, compliance, tax, and back-office terms every Australian SME owner runs into — from BAS and payroll tax to the connected back-office model.

Finance & accounting

Bookkeeping: Bookkeeping is the day-to-day recording of an Australian business's financial transactions — bank reconciliations, accounts payable, accounts receivable, payroll entries, and the maintenance of the general ledger. A bookkeeper produces the data that the accountant uses for tax and the owner uses for decisions. Modern bookkeeping is largely cloud-based (Xero, MYOB, QuickBooks) with bank feeds and AI-assisted categorisation; the human role has shifted from manual data entry to review, exception handling, and reporting. For SMEs above ~10 staff, bookkeeping is one component of a wider back-office function, not a standalone solution.
BAS (Business Activity Statement): The BAS is the periodic statement Australian businesses lodge with the ATO reporting GST collected, GST paid, PAYG withholding, PAYG instalments, and other tax obligations. Most SMEs lodge quarterly; larger businesses lodge monthly. The BAS is due 28 days after the end of the relevant period (longer with a registered BAS agent). A registered BAS agent must hold current TPB registration, professional indemnity insurance, and meet ongoing CPE requirements. Late or incorrect BAS lodgements attract general interest charges and potential penalties.
GST (Goods & Services Tax): GST is Australia's 10% value-added tax applied to most goods and services. Businesses with annual turnover above $75,000 must register for GST; below that threshold, registration is optional. Registered businesses charge GST on taxable sales and claim GST credits on business purchases. Some supplies are GST-free (basic food, education, health services); some are input-taxed (financial services, residential rent). GST liability is reported and paid via the BAS.
PAYG (Pay As You Go): PAYG is the system by which the ATO collects income tax from employees and businesses progressively throughout the year, rather than as a lump sum at year-end. PAYG withholding refers to amounts withheld from employee wages and remitted to the ATO via the BAS. PAYG instalments refer to advance payments of expected income tax for businesses and individuals with investment income. Both are calculated against current ATO tables and lodged through the BAS.
Payroll tax: Payroll tax is a state-based tax on wages paid above a state-specific threshold. Each Australian state and territory sets its own threshold and rate. Approximate 2026 thresholds: NSW ~$1.2M, VIC ~$700k, QLD ~$1.3M, WA ~$1M, SA ~$1.5M, TAS ~$1.25M. Businesses operating in multiple states aggregate group wages and apportion the tax across jurisdictions. Payroll tax obligations frequently catch out growing SMEs that cross the threshold without re-checking their position.
Superannuation guarantee: The superannuation guarantee is the minimum employer contribution to an employee's superannuation fund, set by federal legislation. The rate is 12% (since 1 July 2025). From 1 July 2026, payday super applies: contributions are due with each pay run and must reach the employee's fund within 7 business days of payday — the old quarterly deadlines no longer apply (the final quarterly payment, covering April–June 2026, is due 28 July 2026). Late payment attracts the redesigned Superannuation Guarantee Charge (the shortfall plus daily notional earnings plus an administrative uplift) — still one of the most expensive payroll errors.
Single Touch Payroll (STP): STP is the ATO-mandated real-time payroll reporting system. Each pay run, the employer's payroll system reports gross wages, PAYG withheld, and super liabilities directly to the ATO. STP Phase 2 (operational since 2022) requires more granular reporting including employment basis, leave categories, and disaggregated income types. Most cloud payroll systems handle STP automatically; the practical effect is that the ATO sees payroll data in near-real-time rather than at year-end.
Chart of accounts: The chart of accounts is the structured list of all financial accounts (asset, liability, equity, income, expense) a business uses to record transactions. A well-designed chart of accounts produces meaningful management reports without manual rework; a poorly-designed one produces noise. For an SME, the chart of accounts is typically set up by the bookkeeper or accountant and refined annually as the business grows.
Accrual accounting: Accrual accounting recognises revenue when earned and expenses when incurred, regardless of when cash is received or paid. It contrasts with cash accounting, which recognises transactions only when cash moves. Accrual accounting produces a more accurate picture of business performance over a period and is the default for businesses above the small business turnover threshold. Most cloud accounting systems support both methods.
Cash accounting: Cash accounting recognises revenue when received and expenses when paid. It's simpler than accrual accounting and is permitted for smaller businesses (under the small business turnover threshold). It can distort the view of period performance because timing differences (e.g., a large invoice issued in June and paid in August) move income between periods. Most growing SMEs migrate to accrual accounting as the business scales.
Profit and Loss statement: The P&L (also "income statement") summarises revenue and expenses over a period, producing a net profit or loss figure. For an SME, the P&L is the primary tool for understanding period performance. A monthly P&L is standard for businesses past ~10 staff; the report should drop within 7-10 business days of month-end to be useful for current decisions.
Balance sheet: The balance sheet is a snapshot of a business's assets, liabilities, and equity at a point in time. It shows what the business owns, what it owes, and the net position. Key balance sheet metrics include working capital, debt-to-equity ratio, and current ratio. For SMEs, balance sheet review is typically monthly; for owner-managed businesses with stable financing, quarterly is often sufficient.
Cash flow forecast: A cash flow forecast projects expected cash inflows and outflows over a future period. The simplest version is a monthly forecast for the next 3-6 months; the operationally most useful version for SMEs is a 13-week rolling forecast updated weekly. Cash flow forecasting answers the question "can we afford X?" — a question SMEs frequently make without a model because the model doesn't exist.
13-week rolling forecast: A 13-week rolling forecast projects cash position week-by-week for the next 13 weeks, updated weekly so the forecast always extends 13 weeks ahead. It's the most operationally useful cash flow tool for SMEs because the time horizon matches the decision horizon (most operating decisions affect cash within 13 weeks). A 13-week rolling forecast is a standard deliverable in modern integrated back-office engagements.
Management accounts: Management accounts are internal financial reports produced for the owner and management team to support decision-making. They typically include monthly P&L, balance sheet, cash flow statement, and KPI dashboard. Unlike statutory financial statements, management accounts are tailored to the business's specific needs and may include segment, product-line, or job-costing breakdowns.
Trial balance: The trial balance is a listing of all general ledger accounts and their current balances. It's used to verify that total debits equal total credits (a basic accounting check) and as the starting point for producing financial statements. Modern cloud accounting systems produce the trial balance on demand; it's the document the external accountant typically requests at year-end for tax preparation.
General ledger: The general ledger is the master record of all financial transactions for a business, organised by account. Every transaction in the bookkeeping system flows into the general ledger. It's the source of truth from which all financial reports are produced.
Reconciliation: Reconciliation is the process of comparing two sources of financial data and resolving any differences. The most common is bank reconciliation — matching the accounting system's record of transactions against the bank statement. Other reconciliations include supplier statement reconciliation, payroll reconciliation against STP submissions, and inter-system reconciliation (e.g., POS to accounting system).
Accounts payable: Accounts payable (AP) refers to amounts a business owes to suppliers and other creditors. The AP function includes receiving bills, obtaining approvals, scheduling payments, and reconciling supplier statements. For SMEs, modern AP processes use document extraction tools (Dext, Hubdoc) to automate bill capture and approval workflow tools (ApprovalMax, Lightyear) to manage authorisation.
Accounts receivable: Accounts receivable (AR) refers to amounts owed to a business by customers. The AR function includes invoicing, payment terms management, collections, and aged debtor reporting. For SMEs, AR is often the largest single working capital line; effective AR management materially affects cash position and operating cash flow.
Fixed asset register: The fixed asset register lists all the business's depreciable assets (equipment, vehicles, computer hardware, leasehold improvements) with their purchase cost, depreciation method, accumulated depreciation, and current net book value. It feeds the depreciation calculation that flows into the P&L and underpins the small business instant asset write-off and other concessions.
Depreciation: Depreciation is the systematic allocation of an asset's cost over its useful life. For tax purposes, ATO publishes depreciation rates and methods; for accounting purposes, businesses may use different methods. The instant asset write-off allows immediate deduction of eligible asset purchases below threshold amounts, simplifying the depreciation treatment for smaller assets.
Working capital: Working capital is the difference between current assets (cash, receivables, inventory) and current liabilities (payables, short-term debt). It measures the business's short-term operational liquidity. Positive working capital means the business can meet short-term obligations from current assets; negative working capital often signals cash flow stress.
Operating cash flow: Operating cash flow is the cash generated from the business's core operating activities, excluding investing and financing cash flows. It's a cleaner measure of underlying business performance than profit, because it strips out non-cash items (depreciation) and timing differences. Strong operating cash flow is the foundation of business sustainability.
PAYG withholding: PAYG withholding is the system under which a business withholds tax from payments it makes — most commonly employee wages — and remits it to the ATO, usually through the BAS. Amounts withheld are calculated against the ATO's current tax tables and credited against each employee's eventual income tax. It is distinct from PAYG instalments, which are prepayments of the business's own expected income tax. A business must register before it first needs to withhold, and withheld amounts are never the business's money — treating them as working capital is a serious compliance failure.
STP Phase 2: STP Phase 2 is the current phase of Single Touch Payroll, the ATO's real-time payroll reporting system. Where the original phase reported gross wages, PAYG withholding and super liability, Phase 2 requires the data to be disaggregated: employment basis, income types, paid leave categories, allowances and salary-sacrifice amounts are reported separately every pay run, and it largely removes the need to lodge tax file number declarations separately. Most cloud payroll software handles Phase 2 automatically, but reporting is only as accurate as the underlying pay items — misconfigured pay categories are the most common SME error.
BAS agent: A BAS agent is a professional registered with the Tax Practitioners Board to provide BAS services for a fee — preparing and lodging Business Activity Statements and advising on the obligations they cover: GST, PAYG withholding and payroll-related superannuation. The distinction from a tax agent matters: a tax agent's registration also covers income tax returns and broader tax advice, which a BAS agent cannot legally provide. Many SME bookkeepers are registered BAS agents, and lodging through one generally attracts extended lodgement deadlines. If an unregistered provider is preparing your BAS for a fee, that is itself a compliance problem.
Debtor days: Debtor days (also called days sales outstanding, or DSO) measures the average number of days a business takes to collect payment after invoicing, calculated from accounts receivable relative to sales over a period. Rising debtor days means cash is arriving more slowly — often the first measurable sign of collections drift or customer stress — and every extra day is cash the business must fund from somewhere else. Debtor days is a standard metric in SME management reporting, tracked monthly alongside creditor days and the cash flow forecast.
Management reporting: Management reporting is the regular cycle of producing and reviewing internal reports — typically monthly management accounts, KPI dashboards and cash flow forecasts — so owners and managers make decisions from current numbers rather than gut feel. Where statutory reporting looks backward for compliance, management reporting is designed for steering: it compares actuals to budget, flags variances, and tracks the handful of drivers that matter for the specific business. For an SME, the discipline of a fixed monthly reporting rhythm matters as much as the reports themselves.
Job costing: Job costing is the practice of tracking actual costs — labour, materials, subcontractors, allocated overhead — against each individual job, project or client engagement. It answers the question a profit and loss statement cannot: which jobs make money and which quietly lose it. Job costing is essential in trades, construction, professional services and manufacturing, where profitability varies job by job. Done properly it also feeds quoting, because past actuals make future quotes accurate; done poorly, a profitable-looking business can discover too late that its biggest jobs were its least profitable.
Gross margin: Gross margin is the percentage of revenue left after deducting the direct costs of delivering the product or service: gross profit divided by revenue. It is not the same as markup, which expresses profit as a percentage of cost — a 50% markup equals a 33% gross margin, and confusing the two is one of the most common quoting errors in SME trades and retail. Gross margin is the clearest single indicator of pricing health, and tracking it by product line or job type usually reveals where the real profit lives.
EBITDA: EBITDA is earnings before interest, taxes, depreciation and amortisation — a measure of underlying operating profitability that strips out the effects of financing structure, tax position and non-cash accounting charges. Buyers, lenders and valuers use EBITDA, often normalised to remove one-off items and above- or below-market owner salaries, as the common yardstick for comparing businesses, and many SME sale prices are expressed as a multiple of it. EBITDA is not cash flow: it ignores capital expenditure, working capital movements and debt repayments, so it flatters capital-hungry businesses.
Cash conversion cycle: The cash conversion cycle is the number of days between paying suppliers for inputs and collecting cash from customers — calculated as debtor days plus inventory days minus creditor days. It measures how long each dollar is tied up in operations before it comes back. A shorter cycle means the business funds less of its own growth from borrowed or shareholder cash; a lengthening cycle is an early warning of cash strain even while profit looks healthy. For most SMEs the fastest improvements come from invoicing promptly and tightening collections.
Outsourced CFO: An outsourced CFO (or virtual CFO) is a senior finance professional engaged part-time or on retainer to provide the strategic layer of the finance function — cash flow strategy, forecasting, pricing, board and bank reporting, capital raising support — without the cost of a full-time executive. The model suits SMEs that have outgrown bookkeeper-plus-annual-accountant but cannot yet justify a permanent CFO. The common failure mode is engaging an outsourced CFO on top of disconnected bookkeeping and payroll, which leaves them steering from unreliable numbers.

Payroll & people

Modern Award: A Modern Award is one of 122 federal industrial instruments that set minimum employment terms (wages, hours, leave, allowances, classifications) for specific industries or occupations. Most Australian employees are covered by an Award; the few who aren't are typically award-free senior managers or covered by an enterprise agreement. Award compliance is the largest single source of employment-law risk for Australian SMEs — misclassifications and underpayments routinely cost businesses tens of thousands per affected employee.
Fair Work Commission: The Fair Work Commission (FWC) is Australia's national workplace relations tribunal. It sets the National Minimum Wage, makes and varies Modern Awards, resolves unfair dismissal claims, approves enterprise agreements, and adjudicates a range of workplace disputes. The FWC's annual wage review (typically delivered in early June, effective 1 July) sets minimum wage and Award rate increases.
Fair Work Ombudsman: The Fair Work Ombudsman (FWO) is the federal agency that enforces workplace laws — investigating complaints, auditing employers, recovering underpayments, and prosecuting serious breaches. The FWO publishes industry-specific guidance and operates a complaints process accessible to employees. FWO audits are not rare for SMEs and typically focus on payroll records, classification, and Award application.
National Employment Standards (NES): The NES is the minimum set of 11 employment entitlements that apply to all national-system employees in Australia, regardless of Award or agreement. They include maximum weekly hours, annual leave, personal/carer's leave, parental leave, public holidays, notice of termination, redundancy pay, and the right to request flexible working arrangements. Awards and agreements can provide above the NES but not below.
Award classification: Award classification is the process of determining which classification level within an applicable Modern Award an employee falls under, based on their actual duties, qualifications, and experience. Classification determines the minimum wage rate, applicable allowances, and other entitlements. Misclassification is the most common payroll-compliance error in Australian SMEs; classifications should be reviewed annually and whenever a role's scope materially changes.
Casual conversion: Casual conversion is the process by which a casual employee becomes a permanent (full-time or part-time) employee. Under Australian employment law as updated by the Closing Loopholes legislation (2024), casuals employed regularly for at least 12 months have a statutory right to convert in most circumstances. Employers must initiate the conversation; failure to do so creates exposure.
Long service leave: Long service leave (LSL) is a state-based entitlement to extended paid leave after a qualifying period of continuous service with one employer. The qualifying period and accrual rate vary by state (typically 10 years' service for ~2 months' leave, though portable schemes exist in construction and some other industries). LSL accrues as a liability on the balance sheet and is often a significant unrecognised cost for growing SMEs.
Annual leave loading: Annual leave loading is an additional payment (commonly 17.5%) on top of base pay during annual leave, paid where the relevant Award or agreement requires it. Not all Awards include leave loading; for those that do, the loading must be applied correctly. Errors here are a common audit finding.
Personal/carer's leave: Personal/carer's leave (also "sick leave") is the NES entitlement to 10 days' paid leave per year for personal illness or to care for an immediate family or household member. The entitlement accrues progressively and rolls over year-to-year. Pro-rata calculations for part-time employees are based on ordinary hours.
Redundancy pay: Redundancy pay is the NES-mandated payment to an employee whose position is genuinely redundant, calculated based on continuous service. The scale ranges from 4 weeks' pay (1-2 years' service) up to 16 weeks' pay (9+ years). Some Awards and agreements provide additional redundancy entitlements. Genuine redundancy attracts concessional tax treatment under specific ATO rules.
Salary sacrifice: Salary sacrifice is an arrangement where an employee agrees to receive less cash salary in exchange for a benefit (typically additional super contributions, a car, or other benefits). Properly structured, it reduces the employee's taxable income; improperly structured, it triggers FBT or other tax consequences. The arrangement must be documented and prospective (not retrospective).
Reportable fringe benefits: Reportable fringe benefits are fringe benefits provided to an employee that exceed a threshold value and must be reported on the employee's payment summary. They affect calculations for HELP repayments, Medicare levy surcharge, and certain government benefits — even though they're not taxable income to the employee. Common reportable items include novated leases and salary-sacrifice arrangements above threshold.
Workers compensation: Workers compensation is mandatory insurance covering employees for work-related injury or illness. Schemes are state-based: NSW (icare), VIC (WorkSafe), QLD (WorkCover Queensland), and so on. Premiums are calculated against wages and industry risk classification. Failure to maintain current cover exposes the business to direct liability for claims plus penalties.
WHS (Work Health and Safety): WHS legislation (harmonised across most states except VIC, which retains OHS, and WA which has its own) imposes a primary duty of care on businesses to ensure the health and safety of workers and others affected by the business's operations. Compliance includes risk assessments, safe systems of work, training, and incident reporting. Serious breaches can result in significant penalties and, in extreme cases, criminal prosecution.
Psychosocial hazards: Psychosocial hazards are work-related factors that can cause psychological harm — bullying, harassment, excessive workload, role conflict, poor support. Australian WHS regulations now explicitly require employers to identify and manage psychosocial hazards alongside physical ones. Compliance includes documented risk assessment, control measures, and review. This is a newer compliance area many SMEs haven't yet addressed.
RDO (rostered day off): An RDO is a scheduled paid day off accrued under certain Awards (notably the Building & Construction Award) where employees work additional hours during the cycle to accrue the day. RDO administration requires accurate accrual tracking per employee and careful scheduling around project deadlines. Errors here are a common payroll issue in trades and construction.
Payday super: Payday super is the superannuation payment regime that commenced 1 July 2026: employers must pay the superannuation guarantee (12% of qualifying earnings) with each pay run, and the contribution must reach the employee's fund within 7 business days of payday. It replaces the old quarterly SG deadlines (the final quarterly payment, covering April–June 2026, is due 28 July 2026) and the ATO's Small Business Superannuation Clearing House has closed. Late or missed payments attract the redesigned Superannuation Guarantee Charge.
Superannuation Guarantee charge (SGC): The Superannuation Guarantee charge (SGC) is the ATO-administered penalty that applies when an employer fails to pay an employee's superannuation in full and on time. The charge is built from the unpaid shortfall, a notional-earnings component compensating the employee for lost investment returns, and an administrative uplift, all calculated at rates the ATO sets. Under payday super the charge accrues from the missed payment deadline rather than from quarter-end. Because the SGC always costs more than the super originally due — and attracts further penalties if ignored — late super is one of the most expensive payroll errors an SME can make.
Penalty rates: Penalty rates are higher rates of pay that apply when employees work outside ordinary hours — typically evenings, weekends, public holidays and overtime. The applicable rates, and when they trigger, are set by the relevant modern award or enterprise agreement rather than a single national standard, so two businesses in different industries can face quite different penalty structures. Misapplied penalty rates are among the most common causes of underpayment in Australian SMEs, particularly in hospitality, retail and healthcare, and they are a standard focus of Fair Work Ombudsman audits.
Annual leave liability: Annual leave liability is the dollar value of accrued but untaken annual leave sitting on a business's balance sheet. Employees accrue paid leave under the National Employment Standards and any applicable award, and every accrued hour is a real debt the business must eventually fund — paid at the employee's rate when the leave is taken or paid out, not the rate when it accrued, so pay rises quietly inflate the liability. Well-run SMEs monitor leave balances monthly and encourage staff to actually take leave, which manages the liability and the fatigue risk together.
Workers compensation premium: A workers compensation premium is the amount a business pays its state or territory scheme, or licensed insurer, for mandatory workers compensation cover. Premiums are generally calculated against declared wages and the current rate for the business's industry classification, adjusted in many schemes for the business's own claims experience. Each year the employer declares actual and estimated remuneration, and the premium is reconciled against it. Under-declaring wages or misclassifying the business's activities can trigger back-premiums and penalties, so the annual declaration deserves the same care as a tax lodgement.
Independent contractor: An independent contractor is a person who runs their own business and is engaged to deliver a result, rather than employed to work in a role. Whether a worker is genuinely a contractor or actually an employee is determined by the whole of the working relationship — control over how work is done, ability to delegate, who supplies the tools, who bears commercial risk — not by what the contract calls them. Misclassification (sham contracting) exposes a business to back-pay, superannuation and penalties, and contractors paid mainly for their labour may be owed super even when correctly classified. Check the current Fair Work and ATO tests when in doubt.
Right to disconnect: The right to disconnect is a workplace right under the Fair Work Act that allows eligible employees to refuse to monitor, read or respond to work-related contact outside their working hours, unless the refusal is unreasonable. Reasonableness turns on factors such as the reason for the contact, the employee's role and seniority, and whether they are compensated for availability. It does not prohibit after-hours contact — it protects a reasonable refusal to engage with it. SMEs should set expectations in writing; when the right applies to a business of your size is set out by Fair Work.

Operations, IT, cybersecurity

Essential Eight: The Essential Eight is the Australian Cyber Security Centre's prioritised set of eight strategies to mitigate cybersecurity incidents: application control, patch applications, configure macro settings, user application hardening, restrict admin privileges, patch operating systems, multi-factor authentication, regular backups. Maturity is measured at three levels (Maturity Level 1 to 3). Most Australian SMEs target Maturity Level 1 as a credible baseline; specific industries (defence supply chain, healthcare) may need higher.
Multi-factor authentication (MFA): MFA is the practice of requiring two or more independent verification factors to log in to a system — typically something the user knows (password) plus something the user has (a phone, hardware token, or authenticator app). MFA is the single most effective control against credential-based attacks; the Essential Eight requires MFA for privileged accounts, remote access, and any system holding important data. For SMEs, MFA should be enforced across email, accounting systems, and HR/payroll systems at minimum.
Privacy Act 1988: The Privacy Act 1988 (Cth) is Australia's federal privacy legislation. It sets out the Australian Privacy Principles (APPs) — 13 principles covering collection, use, disclosure, storage, and access to personal information. Most businesses with annual turnover above $3M are covered; smaller businesses are covered in specific circumstances (health service providers, businesses dealing with credit reporting, etc.). The Notifiable Data Breaches scheme operates under the Act.
APP (Australian Privacy Principles): The 13 APPs set out under the Privacy Act 1988 cover open and transparent management of personal information (APP 1), anonymity and pseudonymity (APP 2), collection (APP 3-5), use and disclosure (APP 6-9), data quality and security (APP 10-11), and access and correction (APP 12-13). Compliance requires documented practices, a privacy policy, and operational controls — not just policy statements.
Notifiable Data Breaches scheme: The Notifiable Data Breaches (NDB) scheme requires entities covered by the Privacy Act to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) of any "eligible data breach" — a breach likely to result in serious harm. The notification timeframe is "as soon as practicable" after the breach is assessed as eligible. Failure to notify attracts substantial penalties.
Mandatory data breach reporting: See Notifiable Data Breaches scheme. The reporting obligation is triggered when an eligible data breach is identified or suspected; an initial assessment period of 30 days applies. The OAIC publishes guidance on what constitutes an "eligible" breach and the notification process.
EDR (Endpoint Detection & Response): EDR is a class of cybersecurity tools that monitor endpoint devices (laptops, desktops, servers) for suspicious activity and can respond to threats automatically or with human intervention. EDR replaces traditional signature-based antivirus with behaviour-based detection. For SMEs, EDR is increasingly considered table-stakes alongside MFA and backups.
Patch management: Patch management is the discipline of applying vendor security updates to operating systems and applications in a timely way. The Essential Eight specifies patching cadences (within 48 hours for critical vulnerabilities at higher maturity levels). Effective patch management requires both technical tooling (to deploy patches at scale) and process discipline (to confirm patches actually applied successfully).
Backup retention policy: A backup retention policy defines how long different categories of backups are kept and where they're stored. A typical SME policy might include daily backups kept 30 days, weekly backups kept 12 weeks, monthly backups kept 12 months, annual backups kept 7 years. The policy should also specify offsite storage, immutability (protection against ransomware encryption of backups), and tested restore procedures.
Disaster recovery plan: A disaster recovery plan documents the steps to restore business operations after a major disruption — ransomware, fire, hardware failure, cloud outage. It specifies RTO (Recovery Time Objective: how quickly systems must be back up) and RPO (Recovery Point Objective: how much data loss is acceptable). For SMEs, the plan should be documented, tested at least annually, and accessible to multiple people.
Microsoft 365: Microsoft 365 is Microsoft's cloud productivity suite — Outlook/Exchange, Word, Excel, PowerPoint, Teams, OneDrive, SharePoint. For Australian SMEs it's one of the two dominant productivity platforms (Google Workspace being the other). M365 includes substantial cybersecurity tooling (Defender, conditional access, MFA) that's often under-utilised.
Google Workspace: Google Workspace is Google's cloud productivity suite — Gmail, Docs, Sheets, Slides, Drive, Meet, Calendar. For Australian SMEs it's one of the two dominant productivity platforms (Microsoft 365 being the other). Workspace's security features include 2-step verification, advanced protection, and admin console policies.
SaaS (Software as a Service): SaaS is software delivered over the internet on a subscription model rather than installed locally. Most modern business software (Xero, Salesforce, Slack, HubSpot, Microsoft 365, Google Workspace) is SaaS. SaaS reduces upfront capital cost and simplifies deployment but introduces dependency on the vendor's uptime, data handling practices, and pricing.
CRM (Customer Relationship Management): A CRM is a system that records customer interactions, sales pipeline, and customer-facing data. Common SME CRMs include HubSpot, Salesforce, Pipedrive, and Zoho. A CRM connects to marketing automation, sales workflow, and (in mature implementations) to the financial system for revenue forecasting.
ERP (Enterprise Resource Planning): ERP is integrated software that manages core business processes — finance, supply chain, manufacturing, HR, customer relationship management — in a single system. For Australian SMEs, true ERP (NetSuite, SAP Business One, Microsoft Dynamics) typically becomes relevant past 50-100 staff; below that, integrated stacks of best-of-breed SaaS tools usually serve the need at lower cost and complexity.
Workflow automation: Workflow automation refers to tools and configurations that route work between people and systems automatically — e.g., a new staff member triggers an onboarding workflow that creates accounts in payroll, HR, IT, and CRM systems. Common workflow tools include Zapier, Make, n8n, and platform-native automation (HubSpot workflows, Xero rules). Workflow automation is a major source of operating leverage in modern back-offices.
Essential Eight maturity levels: Essential Eight maturity levels are the Australian Signals Directorate's scale for measuring how thoroughly an organisation has implemented the eight Essential Eight mitigation strategies. The model runs from Maturity Level Zero (significant gaps) through Levels One to Three, each pitched against increasingly capable attacker tradecraft — Level One addresses commodity attacks, Level Three more adaptive adversaries. A target level should match the organisation's threat profile, and assessment is made against the ASD's current published criteria across all eight strategies together, not one at a time. Contracts, insurers and government supply chains increasingly ask SMEs to evidence a specific level.
Business email compromise (BEC): Business email compromise (BEC) is a fraud in which an attacker uses a compromised or convincingly spoofed email account to trick a business into paying money or revealing data — most commonly a fake invoice, a supplier's 'updated' bank details, or an urgent payment request appearing to come from the CEO. BEC consistently ranks among the most financially damaging cybercrimes reported to Australian authorities because it defeats technology through people. The strongest defences are procedural: verify any bank-detail change by phone on a known number, enforce MFA on email, and require dual approval for payments.
Managed service provider (MSP): A managed service provider (MSP) is an external firm that runs some or all of a business's IT on an ongoing contract — typically device management, helpdesk, Microsoft 365 or Google Workspace administration, backups and security monitoring — for a fixed monthly fee per user or device. For most Australian SMEs an MSP replaces the call-someone-when-it-breaks model with proactive management. Quality varies widely, and an MSP's security practices effectively become your security practices, so their Essential Eight alignment, patching discipline and response times deserve real due diligence.
Cyber insurance: Cyber insurance is cover for losses arising from cyber incidents — typically incident response costs, business interruption, data recovery, and the legal and notification costs that follow a data breach, with some policies also covering cybercrime losses such as funds lost to business email compromise. Policies vary widely in what they exclude. Insurers increasingly require evidence of baseline controls — MFA, backups, patching — before they will offer cover or pay a claim, so a policy complements the Essential Eight rather than substituting for it. SMEs should check exactly which incident types and costs their policy responds to.
Key person risk: Key person risk is the exposure a business carries when critical knowledge, relationships or capability sit with one individual — if that person is suddenly unavailable, revenue, operations or compliance are immediately impaired. In SMEs the key person is very often the owner, but it can equally be the one bookkeeper who understands the payroll or the technician holding all the system passwords. Standard mitigations are documentation (SOPs), cross-training, access held by roles rather than individuals, and in some cases key person insurance. It is the most common finding when SMEs assess their operational resilience.
Standard operating procedure (SOP): A standard operating procedure (SOP) is a documented, step-by-step description of how a recurring task is done in a specific business — precise enough that a competent person can execute the task consistently without asking the person who normally does it. SOPs turn individual know-how into organisational capability: they shorten onboarding, reduce key person risk, make quality auditable, and are the raw material for automation, since a process must be defined before it can be systematised. The test of a good SOP is simple — someone unfamiliar with the task can follow it and get the standard result.
Delegation of authority: A delegation of authority is the formal record of who in a business may commit it to what — who can approve spending at each level, sign contracts, hire staff or authorise payments — usually set out in a schedule or policy approved by the owner or board. Without one, either everything routes through the owner (a bottleneck) or approvals happen informally (a control gap and a fraud risk). A written delegation of authority is what lets an owner step back without losing control, which is why it is central to reducing founder dependency.

Tax-specific

R&D Tax Incentive: The R&D Tax Incentive is the federal scheme providing tax offsets for eligible research and development activities. The refundable component (for entities under $20M turnover) is calculated against company tax rate plus a premium. Eligibility requires the activity to meet the definition of "core R&D activity" or "supporting R&D activity" — a substantive test that catches out claims based on routine business improvements.
Instant asset write-off: The instant asset write-off allows eligible small businesses to immediately deduct the full cost of eligible depreciating assets up to a threshold amount, rather than depreciating over years. The threshold amount and eligibility rules are reset by government from time to time; current settings should be checked against the ATO's current guidance.
FBT (Fringe Benefits Tax): FBT is a federal tax on certain non-cash benefits employers provide to employees or their associates — typically motor vehicles, car parking, entertainment, and certain reimbursements. The FBT year runs 1 April to 31 March (different from the financial year). The tax is calculated at the top marginal rate plus Medicare levy on the gross-up value of the benefit. FBT exposure often surprises growing SMEs that haven't structured their employee benefits with FBT in mind.
CGT (Capital Gains Tax): CGT applies to gains from the disposal of capital assets, including business assets. CGT is not a separate tax — gains are included in assessable income and taxed at the marginal rate, with various concessions reducing the effective rate. Small business CGT concessions can substantially reduce or eliminate CGT on the sale of an active business asset for eligible small businesses.
Small business CGT concessions: The small business CGT concessions are four federal concessions (15-year exemption, 50% active asset reduction, retirement exemption, rollover) that can substantially reduce or eliminate CGT on the sale of an active business asset. Eligibility requires meeting either the $2M small business turnover test or the $6M maximum net asset value test, plus various asset-specific tests. The concessions are complex and typically require specialist tax advice.
Division 7A: Division 7A of the Income Tax Assessment Act 1936 deems certain loans, payments, and forgiven debts from private companies to shareholders or their associates to be unfranked dividends. The rules are designed to prevent shareholders from extracting company profits as loans rather than dividends. Compliance requires formal loan agreements, minimum interest rates, and structured repayments — areas where SMEs frequently get caught out at audit.
Trust distributions: Trust distributions are the allocations of trust income to beneficiaries that determine the tax treatment of that income. Distributions must be made by trust resolution before 30 June each year (in most cases) and properly documented. Recent ATO guidance has tightened the scrutiny on certain distribution patterns (notably section 100A reimbursement arrangements), creating more compliance risk for trust structures than was previously the case.
ATO portal: The ATO portal (Online services for business, Online services for agents) is the primary system for businesses and tax agents to interact with the ATO — lodging BAS, viewing accounts, managing payment arrangements, accessing reports. Access requires myGovID and a Relationship Authorisation Manager (RAM) authorisation. The portal has expanded substantially in recent years and now handles most non-substantive ATO interactions.

Industry-specific compliance

TPAR (Taxable Payments Annual Report): TPAR is the annual report businesses in certain industries (building and construction, cleaning, courier and road freight, IT, security, investigation, surveillance) must lodge with the ATO summarising payments to contractors. Lodgement is due 28 August for the prior financial year. The ATO cross-references TPAR data against contractors' tax returns; discrepancies trigger investigations on both parties. TPAR errors are a leading source of trades and construction industry tax penalties.
NDIS price guide: The NDIS price guide is the schedule of maximum prices providers can charge for services delivered under the National Disability Insurance Scheme. The guide is updated periodically and varies by service type, geographic region, and time of day. NDIS providers must price within the guide; pricing errors can affect funding claims and provider registration.
NQF (National Quality Framework): The NQF is the regulatory framework for early childhood education and care providers, covering long day care, family day care, outside school hours care, and preschools. It includes the National Quality Standard (7 quality areas), the Education and Care Services National Regulations, and an assessment and ratings process. NQF compliance is a substantial operational requirement for childcare providers.
Building Code of Australia: The Building Code of Australia (BCA), part of the National Construction Code, sets technical requirements for the design, construction, and performance of buildings. The BCA is given legal effect through state and territory building legislation. Compliance is verified through development approval and building certification processes; non-compliance can result in inability to obtain occupancy approval or insurance.
Food Standards Code: The Australia New Zealand Food Standards Code is the joint Australian and New Zealand regulatory framework for food safety, labelling, and composition. Enforcement is by state and territory food authorities. Food businesses (including hospitality) must comply with relevant standards covering food safety practices, premises and equipment, transport and storage, allergen management, and labelling.
Liquor licensing: Liquor licensing is state-based regulation of the sale and supply of alcohol. Each state has its own liquor authority (e.g., NSW Liquor & Gaming, VCGLR in Victoria) and licence categories. Compliance covers licence conditions, responsible service of alcohol (RSA) training, harm minimisation, and trading hours. Penalties for breach can include licence suspension or cancellation.

Category-defining vocabulary

Connected Back-Office: A connected back office is a single integrated team that delivers an Australian SME's finance, people, operations and growth functions under one accountable Trusted Advisor and one shared data layer — instead of assembling and coordinating six or more separate vendors. The defining feature is that the team coordinates internally and presents the business with one Trusted Advisor as the single point of contact across the whole back office. See The Connected Back Office for the full treatment.
Trusted Business Advisor: A Trusted Business Advisor is the single accountable person who holds the full picture of an Australian SME's back-office and is the owner's first call for any cross-functional question. The role isn't a tax accountant, a bookkeeper, a consultant, or a fractional CFO — it's a structural position that sits above all of those, coordinating the team that does the actual work and translating between the owner and the operational layer.
Integrated back-office: The integrated back-office is an operating model where finance, people, IT, and growth functions are delivered by one coordinated team with shared data, shared accountability, and a single Trusted Advisor — rather than by separate vendors the SME owner coordinates. The integration is in the team and the accountability, not just in the software.
Fractional back-office: A fractional back-office is a model where an Australian SME accesses a full-strength integrated team — finance, HR, IT, growth — at a fraction of the cost of building each role in-house. The economics work because the team's specialists serve several SMEs concurrently rather than one.
Coordination tax: The coordination tax is the hidden cost an SME pays for running its back-office across multiple unconnected vendors — the owner's hours spent translating between providers, the duplicated work, the gaps where things fall through, and the slow decisions where cross-functional context is missing.
Provider fragmentation: Provider fragmentation describes the state in which an Australian SME's back-office is delivered through six or more separate vendors — bookkeeper, accountant, payroll provider, HR consultant, IT firm, marketing agency — with no integration between them. Provider fragmentation is the Australian SME default and the source of most coordination tax.
Back-office stack: The back-office stack is the set of providers, software systems, and processes that collectively deliver an SME's back-office functions. A "fragmented" stack has many separate vendors with limited integration; an "integrated" stack has one team delivering across functions with shared data and shared accountability.
Fragmented stack: A fragmented stack is the default Australian SME back-office structure: separate providers for each function (bookkeeping, accounting, payroll, HR, IT, marketing) with no integration between them. The SME owner becomes the de facto integration layer. The hidden cost of the fragmented stack — the owner's coordination time, duplicated work, and the errors that fall between providers — sits on top of the visible provider invoices and is rarely measured.
BPO (Business Process Outsourcing): BPO is a model originally designed for large enterprises with high-volume, repeatable processes. The work is typically offshore, priced per-task or per-FTE, governed by service-level agreements, and structured for execution at scale and low unit cost. BPO is generally not the right fit for Australian SME back-office work because the compliance depth and judgement required don't suit the BPO operating model.
AI-enabled back-office: An AI-enabled back-office is one where AI tooling has substantially automated the production tasks (categorisation, document extraction, draft generation, anomaly detection) and the human team has shifted to judgement, integration, and advisory work. AI-enabled does not mean human-replaced; it means the human time is spent on the work where judgement matters.
Founder dependency: Founder dependency is the degree to which a business relies on its owner to function — the decisions only they can make, the relationships only they hold, and the knowledge that lives only in their head. A founder-dependent business is harder to scale, harder to sell, and carries key-person risk: if the owner steps away, parts of it slow or stop. Reducing founder dependency means moving decisions, context and relationships out of the owner's head and into people, documented processes and systems. See Founder Dependency for the full treatment.
Back-office capability gap: The back-office capability gap is the space between the operating capability a growing SME needs — across finance, people, operations and technology — and the full-time specialist team it can economically justify hiring. A business too big to run on the owner and a bookkeeper, but too small to employ a CFO, an HR manager and an IT lead, sits in the gap. It is a structural reason the connected back office exists: it delivers the capability without the full-time headcount. See The Back-Office Capability Gap for the full treatment.
Owner absence test: The owner absence test is a simple diagnostic for founder dependency: could the owner step away from the business for four weeks without it slowing, stalling or creating risk? Working through each function in turn — would finance keep running, would compliance still be met, would decisions still get made, would clients still be looked after — reveals exactly where the business depends on the owner personally rather than on people and systems. See The Owner Absence Test for the full treatment.
Fractional executive: A fractional executive is a senior leader — CFO, COO, head of people, CTO — who works inside a business for a defined fraction of a full-time load, typically serving several businesses concurrently. Unlike a consultant, a fractional executive holds ongoing operational responsibility: they own outcomes, not recommendations. The model gives SMEs access to executive-grade capability years before they could fund the full-time salary. The fractional back-office extends the same economics from a single role to an entire integrated function.

Looking for the longer treatment of a term? Browse the Insights library or take the Business Health Check.

Not sure which of these apply to your business?

The Business Health Check takes 5 minutes and shows you where the gaps are across finance, people, operations, and growth — in plain English.

Take the Health Check Book a Discovery Call