How to Set Up a Tax Audit Data Room in 5 Minutes
Step-by-step guide: create a room, upload tax returns, scan for TFNs, invite the auditor. Your documents are secure before your coffee goes cold.
You've just been notified of a tax audit. The ATO wants documents. Your client is nervous. Here's how to have a secure, professional data room ready before your coffee goes cold.
Step 1: Create the room (30 seconds)
Log into ShareAndGo, click "Create Data Room," and name it something clear: "Smith & Co, ATO Audit Q3 2026." Add your firm's logo if you want it branded. Done.
Step 2: Upload documents (2 minutes)
Drag and drop your files straight from Finder or Explorer. Tax returns, BAS statements, financial reports, bank statements, they all go in. Create folders if you want structure: "Financials," "BAS," "Correspondence." ShareAndGo's AI automatically extracts text from PDFs and scanned documents, making everything searchable.
Step 3: Scan for sensitive data (1 minute)
Right-click any document and select "Scan for Sensitive Data." ShareAndGo's AI detects Tax File Numbers, ABNs, BSB numbers, bank account numbers, and Medicare numbers. You'll see a list of detected items with severity ratings. Toggle which ones to redact, click "Redact," and a clean copy is generated. Your client's TFN stays hidden from anyone who doesn't need it.
Step 4: Invite the auditor (1 minute)
Click "Invite," enter the auditor's email, and choose their access level (View Only is usually right for auditors). They'll receive an email with an access link and verify their identity with a 6-digit code, no passwords to manage, no accounts to create. You can invite up to 50 people at once if the audit team is larger.
Step 5: Track everything
From the moment the auditor opens the link, every action is logged: which documents they viewed, for how long, from which IP address. If they have questions, they can use the Q&A tab to ask, you get an email notification and can reply directly. The full thread is tracked and timestamped.
What your client sees
Your client sees a professional, branded data room. Not a Dropbox link. Not an email attachment. A secure workspace that says "this firm takes confidentiality seriously." That matters when the ATO is involved.
After the audit closes
When the engagement wraps, you don't have to scramble to claw documents back from inboxes. Revoke the auditor's access with one click and their link stops working immediately. Export the full audit log — every view, every download, every Q&A exchange, timestamped — as your record of exactly what was shared. Archive the room so it's out of your active list but preserved if a question comes up next year. Nothing lingers in someone's email forever.
Three mistakes to avoid
- Sharing the raw files instead of a room. An email attachment or a Dropbox link can be forwarded, downloaded and re-shared with no trace. A view-only room with an audit trail can't.
- Skipping the PII scan. It takes a minute and it's the step that stops a client's TFN reaching someone who didn't need it — an APP 11 problem you don't want.
- Giving the auditor edit or download rights "just in case." View-only is almost always correct for an auditor. Grant the least access that lets them do their job.
Frequently asked questions
Does the auditor need to create an account? No — they verify with a 6-digit code sent to their email, so there's nothing for them to manage and nothing for you to provision. Where is the data stored? In Sydney, Australia (australia-southeast1) — onshore, which is exactly what you want for ATO matters. Can I see whether they actually opened a document? Yes — the audit log shows which documents were viewed, for how long, and from which IP address.
The bottom line
From "we've been notified of an audit" to "the auditor has a secure, redacted, fully-logged data room" is about five minutes of work. The alternative — emailing sensitive financials around and hoping for the best — takes longer, looks worse, and carries real privacy risk. Five minutes is cheap insurance.