APES 325 Risk Management for Accounting Firms

APES 325 requires accounting firms to document how they identify and manage business risks, then keep that framework working. A small practice can use a short written policy and risk register, with someone responsible for each risk and evidence of review.

What APES 325 Expects a Firm to Have

APES 325 Risk Management for Firms is issued by the Accounting Professional & Ethical Standards Board (APESB). It applies to members in public practice whose professional body adopts it, including sole practitioners. APESB lists the 2023 revision among its current pronouncements.

The standard requires a documented framework, ongoing monitoring and communication of risk policies to personnel. It also requires a documented succession plan. A register alone leaves out how you make decisions and what happens when a policy is breached.

Ultimate responsibility sits with the chief executive or managing partner, including an equivalent role. An appropriate managing board of partners can hold that responsibility. In a sole practice, the principal holds that responsibility. Assigning daily checks to staff leaves leadership accountable.

Scale the document to your services and how you operate. A sole practitioner with one office can keep it short, provided it covers the risks and arrangements that actually exist.

The Parts of a Risk Management Framework

A usable framework explains how your practice identifies risks, assesses their seriousness and decides what action to take. It also sets out how you monitor those actions and tell staff what they must do.

Start with your practice’s risk appetite: the exposure you accept and the circumstances in which you refuse work. For example, you can require specialist support before accepting work outside your staff’s experience.

Use the following categories to find risks that a small tax practice can overlook.

Category	Questions for your practice
Client and engagement	Can you understand the client’s affairs, deliver the work and recover the fee?
Regulatory	Who checks changes to TPB obligations and identifies designated services under AML/CTF rules?
Cyber and data	Who can access client records, and can you recover them after an incident?
People and continuity	Who takes over urgent work if the principal or another experienced staff member is unavailable?
Financial	Can cash reserves cover an unpaid fee, insurance excess or interruption to work?
Governance and stakeholders	Who approves exceptions, handles complaints and checks outsourced work?

Registered tax practitioners must account for the TPB Code obligations that apply to their work. These include competence and confidentiality, as well as professional indemnity insurance.

AML/CTF obligations depend on the services you provide and the applicable geographical link and exemptions. Use AUSTRAC’s professional designated services guidance to assess applicability. A practice’s occupation alone does not settle which services are regulated.

For each risk, record a responsible person and a next review date. Add the evidence that lets that person test whether the action works, such as a backup recovery record or overdue-work report.

Where APES 325 Stops and Quality Management Starts

APES 325 covers firm-wide business risk, while APES 320 addresses the quality management arrangements for non-assurance services. Assurance practices also have the applicable ASQM requirements. The APESB technical update explains their connection.

One document can cover both APES 325 and APES 320 if you clearly map its sections to each standard’s requirements. Keep the detailed APES 320 quality management work alongside your broader business risks.

Client Acceptance Risk When a New Client Signs on

Client acceptance gives your practice the information it needs to decide whether it can take on the work safely. Record the following factors before approving the engagement.

• The number and types of entities, including trusts and related companies.
• Overseas owners, activities or transactions that need further assessment.
• Cash-heavy operations and the records available to support their figures.
• Overdue lodgments and the time needed to bring them up to date.
• Previous ATO disputes and the matters still unresolved.
• Fee recovery risk, including unpaid fees and the proposed billing arrangement.

Use a consistent low, medium or high rating for each factor. Define the ratings in your framework so staff know which answers require further enquiries. A risk rating records a decision about a particular client and service, not an accusation about the client.

For example, an invented new company client has several related entities and overdue returns. Rate those factors high until you establish the work involved and whether your practice has capacity. Your policy can require principal sign-off and a written catch-up plan before acceptance. Decline the work if the remaining exposure exceeds your practice’s risk appetite.

Collect the same starting answers through a guided form. Tax Genie records client and entity details in one request and keeps the answers with the client’s record. Staff can use those answers when documenting their acceptance decision and the reasons behind it.

Complete the separate due diligence for client acceptance that apply. Revisit the acceptance rating when the client adds an entity, changes ownership or asks for a different service. A previous low rating does not describe work you have never assessed.

A Risk Register for a Small Practice

A risk register records each risk, its likelihood and impact, the actions you use to reduce it and who checks them. The rows below are invented illustrations for a small practice. The ratings are examples, not APES 325’s prescribed scoring method.

Risk	Likelihood	Impact	Controls	Owner	Review date or trigger	Evidence
Losing access to ATO online services	Possible	High	Review authorised access and keep a documented access-recovery procedure	Principal	Next scheduled review and any access change	Access review and recovery notes
TFN data breach	Possible	High	Restrict access, train staff and keep a breach response plan	Principal	Any incident or change to data handling	Access review and training record
Missed lodgment deadline	Possible	High	Assign each job, track due dates and escalate incomplete work	Job owner	Weekly overdue-work check	Work list and escalation notes
Principal falls ill	Possible	High	Arrange an authorised alternate and document the continuity handover	Principal	Scheduled review or change to alternate	Succession plan and handover check
Professional indemnity claim	Possible	High	Document scope, review advice and notify the insurer under policy terms	Principal	Renewal, complaint or claim	Engagement records and insurance review

Enter an actual next review date in your working register. The event triggers above prompt an earlier check. Keep individual client names and sensitive details in their own files, with a reference from the register where needed.

The Controls column records what your practice does to reduce the risk. For cyber risk, link the register to your practice cyber security arrangements. For an exposed client record, connect it to your data breach response plan.

Use this APES 325 template structure for the document that surrounds the register.

1. Describe your practice, its services and the risks it will accept.
2. Name the person with ultimate responsibility and each delegated risk owner.
3. Explain how staff identify a risk and assign likelihood and impact ratings.
4. Record risks in the register, including controls, responsible person, review trigger and supporting evidence.
5. Document the succession arrangements for interruption or loss of the principal.
6. Set the monitoring schedule and the steps for reporting a policy breach to leadership.
7. Record corrective actions, staff communication and where supporting documents are retained.

Within that framework, add an onboarding risk such as accepting work beyond the practice’s capacity. Record a high impact if unresolved, principal approval as a control and changed services as a review trigger. Keep the acceptance assessment and signed engagement letter as evidence of the decision.

Keep the register focused on risks that need a decision or a recurring check. Combine duplicate rows, but retain different owners or actions when they change how the risk is managed. A short register with current evidence is easier to review than a long list of generic risks.

Reviewing the Framework and Showing a Reviewer

APES 325 requires ongoing monitoring and periodic evaluation of the framework’s design and effectiveness. It does not prescribe an annual review interval or a fixed list of early-review events. Set a review schedule that fits your practice’s exposure.

As a practical starting point, schedule a full review every 12 months and more frequent checks for fast-changing risks. Review earlier after a breach, complaint, major staff change, new service or change in law. Record this as your practice’s policy, separate from the standard’s requirements.

Give a reviewer the written framework and current register. Have review dates and staff communication records available, alongside the succession plan. Keep evidence of policy breaches and the corrective actions leadership took.

Retain relevant documents long enough for monitoring and any applicable record-retention requirements. The APES 325 standard sets out these documentation obligations.

A document written once and left untouched cannot demonstrate ongoing monitoring or maintenance. Before the review, take one live risk from your register and trace its last check. Confirm who did it, what they found and whether any required action was completed.