SMSF cybersecurity: Protecting client data and audit evidence in the age of AI

Take a second. Protect client information. Preserve audit evidence.

The logo looks professional. The document looks legitimate. The figures match the data feed. But how do we really know whether the document on file can be relied upon?

AI is not just changing how audits are performed. It is challenging long-held assumptions about the documents used to support them. AI makes document fabrication easier to produce and harder to detect. For SMSF professionals, this turns document reliability into an emerging compliance issue. The question is not simply whether a document looks legitimate, but whether its source, content and collection process justify reliance on it.

This Cyber Security Action Month, “Take a second. Stay secure.” is an important reminder that protecting client information and preserving reliable audit evidence go hand in hand. The Australian Signals Directorate’s Annual Cyber Threat Report 2025–26 brings that message into sharp focus. ASD’s Australian Cyber Security Centre received more than 82,000 cybercrime reports during the year, an average of one every six minutes. The report also highlights how AI is making cyber-attacks, scams and phishing attempts faster, more scalable and more convincing.

SMSFs are attractive targets

SMSFs combine two things cyber criminals value: retirement savings and the identity and financial information that can help them reach those savings.

SMSF professionals routinely handle information that is valuable to cyber criminals such as tax file numbers, identity documents, bank details, investment records, trust and company records, and client communications. In the wrong hands, that information can be used to impersonate clients, gain access to accounts, redirect payments, make unauthorised changes or support other forms of fraud.

In its submission to the House of Representatives Select Committee on Cyber Security, the SMSF Association highlighted the particular challenges facing small and mid-sized SMSF practices. The sector relies on the secure exchange of significant volumes of sensitive client information between trustees, accountants, advisers, administrators, auditors, platforms and technology providers. Each connection is necessary but also increases the importance of knowing who is requesting information, where it is going and how it will be handled.

This article outlines four practical actions to help protect client information and preserve reliable audit evidence: verify unexpected requests, preserve reliable source records, provide only the evidence needed and share records securely.

1. Verify requests before sharing client information

A request to provide, replace, redirect or urgently re-send fund documents may look routine, particularly when it appears to come from a familiar email address, colleague, client or technology platform. But a familiar sender is not proof that the request is genuine. Compromised accounts and AI-assisted impersonation make fraudulent communications more convincing and harder to identify.

An unauthorised request could result in sensitive client information being shared with the wrong person, or records being altered, replaced or uploaded outside the usual process. Examples include a request to:

• Upload records to a different portal or shared folder

• Change access permissions for an audit file

• Re-send a document because it has supposedly been “updated”

• Provide identity documents, bank records or other sensitive information outside the usual audit workflow

• Replace a previously provided statement, confirmation or valuation with a new version

A quick verification step can prevent sensitive client information from being sent to the wrong place or the wrong person. If a request is unexpected or changes the usual process, pause and verify it independently before sharing anything.

2. Preserve reliable source records

A document is not automatically sufficient and reliable audit evidence. In a digital environment, it may not be clear who created it, whether it came from an independent source, whether it is complete, or whether it has been altered or manipulated.

Under ASA 500, auditors must consider the relevance and reliability of information used as audit evidence. Its source, nature and the circumstances in which it was obtained all matter. A statement obtained directly from a financial institution and a PDF forwarded through several parties may contain the same numbers and information, but they do not carry the same evidentiary weight. The audit work needed to assess the source and authenticity can differ significantly.

Direct document feeds can help preserve this distinction while reducing manual collection. For example, Class’s 2026 ASAE 3402 Type II data feeds report includes Direct Connect Document Feeds from institutions and share registries. This provides independent assurance over the controls within the report’s scope, rather than blanket assurance over every document stored in the platform.

Keep the source clear

For practices using BGL, Class or SuperMate, start with the records and information already held in your normal workflow. The aim is not to create extra paperwork, but to make clear how documents reached the file.

Keep complete source documents linked to the relevant transaction or workpaper where possible. Where the platform already identifies a document as received through a direct document feed, use that existing information rather than creating a separate record.

For documents obtained outside those feeds, make clear where they came from and how they were received. A statement received from a trustee should be identified as trustee-supplied, even if it was originally issued by a bank or investment provider. Similarly, a schedule prepared or re-created by your practice should be identified as such, with the underlying source records retained.
A brief note such as “provided by trustee” or “prepared by our team from the attached statements” can help explain the document’s origin. If a record has been changed or replaced, its source is unclear or something does not look right, flag it with ASF.

The auditor remains responsible for assessing the evidence. Your role is to keep the underlying records, make their origin clear and highlight anything that needs a closer look.

What the auditor must assess

An SMSF auditor must form an opinion on the fund’s financial report and its compliance with the SIS Act and SIS Regulations. That opinion must be supported by sufficient appropriate evidence. Where information does not come directly from an independent source, AUASB guidance indicates it may need more extensive assessment.

Put simply, a quality audit file needs more than a document that looks plausible. It needs robust, supportable evidence, preferably from an independent third-party, of an asset’s existence, ownership and market value. Where evidence is incomplete, inconsistent, or unreliable, or where its source is unclear, the auditor may need to perform further procedures, seek independent corroboration or direct confirmation, or consider the effect on the audit opinion.

Weak records do not simply slow the audit. They can affect the auditor’s ability to assess compliance and finalise the engagement.

AI changes the evidence risk

The rise of AI does not mean every AI-assisted document is unreliable. It does mean familiar indicators such as a professional layout, recognisable logo or an accompanying website are no longer sufficient.

First, AI makes it easier to fabricate apparently credible third-party records. According to the AUASB’s Impact of AI on Auditors, auditors must be alert to documents that purport to come from third parties but may in fact have been generated or manipulated using AI.

Second, AI-generated summaries, explanations and schedules can be useful working tools, but they are not substitutes for underlying source documents. The AUASB notes that AI summaries may be inaccurate, omit important aspects or use information out of context.

Third, agentic AI adds a workflow risk. Unlike tools that simply generate text, agentic systems can extract, classify or act on information across connected platforms. A manipulated or malicious document can therefore move further and faster through a process before it is detected, particularly in practices with multiple cloud systems and third-party providers.

ASIC has warned that frontier AI is lowering the barrier to sophisticated cyber-attacks and increasing their speed and scale. Its message is practical rather than alarmist:

“The time to act is now, not by reinventing your approach, but by ensuring the basics are robust, resourced, and working effectively.”

For SMSF professionals, those basics include protecting client information, managing third-party technology risk and maintaining reliable document-handling processes.

3. Send the evidence - not the entire client file

The volume of digital records moving through SMSF audit workflows is growing rapidly. Cloudoffis’ SMSF Audit Crunch Report recorded 5.1 million document uploads across 76,289 audit jobs on its platform in FY2026, up 15.6% on the previous year. That is roughly 67 document uploads per audit job.

Digital workflows and audit automation are essential to managing a growing and increasingly complex SMSF sector. But as audit files grow, document volume must not become a proxy for evidence quality. The practical challenge is to identify the documents that are relevant, complete, independently sourced and reliable.

A larger file does not automatically mean better evidence. More documents do not remove the need to assess quality. In fact, as volume increases, it can become harder to distinguish original third-party records from re-created, altered, duplicated, incomplete, irrelevant or AI-generated material. The key question is not “How many documents have been uploaded?” but “What does this document prove, where did it come from, and can it be relied upon?”

More documents also mean more exposure. Uploading unrelated information can increase privacy and cyber risk without improving the audit evidence. APP 11 requires organisations covered by the Privacy Act to take reasonable steps to protect personal information. When it is no longer needed, it must generally be destroyed or de-identified, subject to legal retention requirements.

The call to action is not to provide less evidence. It’s to provide the right evidence: complete, relevant and reliable records, without adding unrelated client material “just in case”.

Before uploading documents to the auditor, pause and ask:

• Is this the correct fund and financial year?

• Does this document answer the audit request?

• Is it a complete source document, rather than an extract, screenshot or re-created schedule?

• If AI has been used to prepare a document, summary or schedule, is that clear and is the source record also included?

• Have unnecessary or unrelated client records or attachments been included?

• Am I providing it through the agreed secure channel and linking it to the correct fund?
  
  

4. Share records securely

Secure sharing protects client information and preserves the evidence trail. Use the agreed secure ASF Audits channel to provide records, whether through an authorised one-click software integration or the Client Portal. Avoid sending SMSF records through unencrypted email.

Check the recipient, fund folder and access permissions. Enable multi-factor authentication wherever possible and give auditors access only to the information they need.

One-click integration can reduce manual handling and create a more secure, efficient process. It does not remove the need to consider whether the underlying records are complete, relevant and reliable.

If records may have been misdirected, replaced or compromised, tell the auditor promptly so the impact on the audit file can be assessed.

If client information may have been accessed, disclosed or sent to the wrong person, act promptly to contain the incident and assess its impact. For organisations covered by the Privacy Act, a breach that is likely to result in serious harm may trigger obligations under the Notifiable Data Breaches scheme, including notification to affected individuals and the OAIC.

Protect client information. Preserve reliable audit evidence.

At ASF Audits, receiving a document is the beginning of the evidence assessment, not the end.
Protecting client information and preserving reliable audit evidence are not separate tasks. Both depend on the same disciplines: pausing before acting, questioning unexpected requests, using trusted channels and understanding where information has come from.

A document should not earn trust simply because it looks legitimate. Before a file is audit-ready, the evidence must be able to show where it came from, how it was handled and why it can be trusted.

In an AI-enabled environment, trust must be evidenced, not assumed.