Payments to foreign resident individuals for personal services Where an Australian business pays a foreign resident individual for work performed, withholding obligations can apply depending on where the work is physically performed and the nature of the engagement — this is a frequent area of confusion, since many businesses assume the location of the paying entity (Australia) is what matters, rather than where the work is actually carried out.

Payments to foreign resident contractors and companies Certain payments to foreign contractors or businesses — particularly for specific categories such as royalties, interest, or dividends — can trigger a separate withholding tax regime, generally deducted at the time of payment rather than assessed later through a tax return.

Remote employees working from overseas An increasingly common scenario: an Australian business employing someone who works remotely from another country. This raises questions not just around withholding, but potentially around payroll tax, superannuation, and even where the employment relationship is considered to be legally based — all of which can differ from how a domestically based employee is treated.

Scenario: A company assumes it qualifies as a base rate entity and franks a dividend using a 25% rate. If a review later determines the company should have been taxed at 30% for that year (because the passive income test wasn't actually met), the franking credit passed to shareholders was calculated on the wrong basis — potentially leaving the company with an under-franked distribution relative to its actual franking account position, and shareholders with an incorrect tax offset on their own returns.

Recalculate aggregated turnover annually, including all connected entities and affiliates — don't assume last year's classification automatically carries forward.
Check the passive income percentage for the specific year, particularly if the company had any unusual capital gains, large interest income, or significant rental income that year.
Confirm the franking rate applied to any dividends matches the company's actual base rate entity status for that year, not an assumed or previous year's status.
Review group structure changes, since a new connected entity or a change in shareholding can affect the aggregated turnover calculation going forward.

Most cyber insurance policies address a combination of:

• First-party costs — your own business's direct costs from an incident, including forensic investigation, data recovery, business interruption, and notification costs under the Notifiable Data Breaches scheme.
• Third-party liability — claims from customers, suppliers, or other parties affected by a breach involving their data.
• Cyber extortion — costs associated with ransomware demands, though coverage and conditions here vary considerably between insurers.
• Regulatory costs — expenses associated with responding to a regulator investigation following a breach.

Failure to maintain "reasonable" security standards. Many policies include a condition that the business maintained reasonable cybersecurity practices — outdated software, unpatched systems, or absent multi-factor authentication can give an insurer grounds to deny a claim after the fact.

Acts of war or state-sponsored attacks. Following some major global ransomware incidents attributed to state actors, insurers have increasingly excluded or limited coverage for attacks attributed to nation-states — a distinction that can be genuinely difficult to establish either way after an incident.

Prior known vulnerabilities. If a vulnerability was known and not remediated before the incident, insurers can deny coverage on the basis the business failed to act on a known risk.

Social engineering and payment redirection scams. Standard cyber policies often exclude or sub-limit coverage for scams where an employee is tricked into authorising a payment — this typically requires a specific endorsement or separate crime insurance.

1. Confirm what security standards the policy requires you to maintain, and whether your actual practices meet them.
2. Check whether social engineering and payment redirection scams are covered, or need a separate endorsement.
3. Review the sub-limits for specific claim types — a large headline coverage figure can mask much smaller sub-limits for the incidents you're most likely to face.
4. Confirm notification and reporting timeframes required under the policy, since late reporting of an incident can itself void coverage.

RBizz can connect you with insurance specialists to review your cyber coverage against your actual risk profile — get in touch before renewal.

A compliance-only relationship is built around processing what you tell them: here's the revenue, here's the expenses, here's the return. There's rarely a moment for pushback in that model, because the job is recording and reporting, not questioning.

A genuine advisory relationship is different. It means an accountant who's actually looking at your structure, your cash flow, your decisions — and is willing to say "this pricing model doesn't cover your real costs" or "this dividend timing is going to hurt you at tax time" or "I don't think this restructure achieves what you think it does."

That kind of pushback isn't the accountant being difficult. It's the accountant actually doing the advisory part of the job, not just the compliance part.

Money tied up in unpaid invoices. You've recognised the revenue and it counts toward profit, but the customer hasn't actually paid yet. A business with slow-paying customers can look highly profitable on paper while genuinely struggling to cover payroll.

Inventory sitting on shelves. Cash spent buying stock doesn't show up as an expense until that stock is sold — meaning a big inventory purchase can drain your bank account without touching your profit figure at all in the same period.

Loan principal repayments. Only the interest portion of a loan repayment is an expense on your P&L. The principal repayment is a real cash outflow every month that never appears as a cost reducing your reported profit.

Tax and GST timing. You've collected GST from customers throughout the quarter, and it sits in your bank account looking like available cash — until the BAS is due and a chunk of that "cash" was never actually yours to spend.

Growth itself. A growing business often needs to spend cash upfront — more stock, more staff, more equipment — well before the resulting revenue and profit show up. Growth is frequently cash-negative even while it's profit-positive.

If you're only reviewing your P&L each quarter and not a rolling cash flow forecast, you're looking at the wrong document to answer "can we actually afford this." Both numbers matter — they just answer different questions.

RBizz builds cash flow forecasting alongside your compliance work, so you're never caught off guard by the gap between profit and what's actually in the bank. Get in touch if you've ever been surprised by your bank balance despite a good year on paper.