Introduction

1.1 The Corporations (Aboriginal and Torres Strait Islander) Act 2006 (CATSI Act) is a special measure under the Racial Discrimination Act 1975 ‘for the advancement and protection of Aboriginal peoples and Torres Strait Islander peoples’, aimed at giving First Nations peoples access to the same opportunities to form and manage corporations as everyone else.⁹ The CATSI Act establishes an incorporation framework for Aboriginal and Torres Strait Islander groups and organisations wishing to incorporate.

1.2 Incorporation enables groups to establish a legal entity separate to its members. The main benefits of incorporating are: protection from liabilities for members; taxation benefits; improved reputation due to the requirement to meet certain governance standards; access to capital; improved succession processes; and more effective management processes that come from decision-making powers being given to a smaller group with oversight from another.¹⁰

1.3 There are additional benefits to incorporating under the CATSI Act rather than other incorporation frameworks, including corporation rules that are relevant to cultures and communities; no fees to lodge forms, documents and reports; and access to information and support including training.¹¹

Office of the Registrar of Indigenous Corporations

1.4 The Registrar of Aboriginal and Torres Strait Islander Corporations (the Registrar) is an independent statutory office holder appointed under the CATSI Act by the Minister for Indigenous Australians. The Office of the Registrar of Indigenous Corporations¹² (ORIC) is established under the CATSI Act within the National Indigenous Australians Agency (NIAA).¹³

1.5 ORIC staff are based in offices in Canberra, Adelaide, Alice Springs, Broome, Brisbane, Cairns, Coffs Harbour, Darwin, Perth and Sydney. ORIC’s annual budget and staffing between 2020–21 and 2024–25 is shown in Table 1.1.

Table 1.1: Annual resourcing, 2020–21 to 2024–25

Note a: As at 30 June.

Note b: Includes funding for initiatives such as leadership and governance activities. ORIC advised the ANAO in May 2026 that this funding ceases on 30 June 2026.

Note c: Includes funding for initiatives such as ORIC’s IT upgrades and the implementation of director identification requirements. ORIC advised the ANAO in May 2026 that this funding ceases on 30 June 2026.

Source: ORIC and NIAA yearbooks and annual reports and ORIC data and advice. Budget figures reported in NIAA annual reports in 2023–24 and 2024–25 and the ORIC 2022–23 yearbook do not include amounts related to projects. The ANAO did not validate the resourcing data.

1.6 The NIAA is an executive agency as defined by section 65 of the Public Service Act 1999 and is a non-corporate Commonwealth entity under the Public Governance, Performance and Accountability Act 2013 (PGPA Act). The 2019 Executive Order to establish the NIAA specifies that the functions of the NIAA include to lead and coordinate Commonwealth policy development, program design and implementation, and service delivery for Aboriginal and Torres Strait Islander people; and analyse and monitor the effectiveness of programs and services for Aboriginal and Torres Strait Islander people, including programs and services delivered by bodies other than the NIAA.

1.7 The NIAA Chief Executive Officer is the accountable authority for ORIC under the PGPA Act. The PGPA Act imposes duties on accountable authorities including: to govern the entity; to establish and maintain systems relating to risk and control; to encourage cooperation with others; and to keep the responsible Minister and Minister for Finance informed about the entity and its activities.¹⁴ The accountable authority is also obliged to observe and consider rules and guidance under the PGPA Act framework, which give effect to the PGPA Act. This includes the Commonwealth Procurement Rules, Commonwealth Grant Rules and Principles, and Department of Finance resource management guides such as RMG 128 Regulator Performance. In addition to providing staff to assist the Registrar, funding for ORIC’s operations (including the engagement of contractors and consultants) are included in the NIAA’s appropriations through the Department of the Prime Minister and Cabinet.¹⁵

1.8 The CATSI Act establishes the Registrar’s functions, powers and aims. Functions include making available to the public information about the registration of Aboriginal and Torres Strait Islander corporations (Indigenous corporations) and the administration of the CATSI Act, providing advice, conducting public education programs, assisting with the resolution of disputes and complaints and conducting research. The Registrar also has a number of powers to regulate Indigenous corporations. The aims established for the Registrar include facilitating and improving the effectiveness, efficiency, sustainability and accountability of Indigenous corporations; having regard to Aboriginal and Torres Strait Islander tradition and circumstances; and administering functions and powers effectively and with a minimum of procedural requirements. The Registrar may delegate their functions and powers to ORIC staff, who must comply with the Registrar’s directions.

1.9 Indigenous corporations play a role in providing services to communities, including through funds received from governments through grants. ORIC advised the ANAO in January 2026 that total 2024–25 grant funding reported by Indigenous corporations as at January 2026 was $1.9 billion, which represented 54 per cent of total reported income for those corporations receiving grant funding. The Registrar has stated that ORIC has a continued focus on strengthening:

• Indigenous people’s trust and confidence in their corporations and the continued protection of a self-determining right to govern, represent, deliver services and protect their inherent rights and interests
• the broader public, government and funders’ trust and confidence in Indigenous corporations.¹⁶

1.10 Auditor-General Report No. 3 2017–18 Supporting Good Governance in Indigenous Corporations concluded that:

ORIC supports good governance in Indigenous corporations by maintaining public registers, monitoring and enforcing compliance, and providing information, advice and education, consistent with the CATSI Act.¹⁷

1.11 The ANAO made three recommendations to: review and update its guidance and procedures for assessing applications for registration as an Indigenous corporation; establish procedures to ensure that persons disqualified by a court or the Registrar are promptly listed on the Register of Disqualified Officers, relevant documents are stored on the register, and such disqualified persons do not continue to hold the positions of director or secretary in Indigenous corporations; and refine its risk rating system in its client relationship management system to better support its regulatory program.¹⁸

Corporations (Aboriginal and Torres Strait Islander) Act 2006

1.12 The CATSI Act was established as an alternative to incorporation under the Corporations Act 2001 (Corporations Act); different state and territory incorporated association laws; or state, territory and national cooperatives laws.¹⁹ Most Aboriginal and Torres Strait Islander groups seeking to incorporate can choose to incorporate under the Corporations Act or the CATSI Act.²⁰

1.13 The CATSI Act was designed to ‘[maximise] alignment with the Corporations Act where practicable, but [provide] sufficient flexibility for corporations to accommodate specific cultural practices and tailoring to reflect the particular needs and circumstances of individual groups’.²¹ Differences between the CATSI Act and Corporations Act include membership arrangements, regulatory assistance and reporting requirements (see Appendix 3).

1.14 The CATSI Act was last reviewed in 2020.²² Amendments to the CATSI Act were introduced to the Parliament in August 2021, which proposed changes to the Registrar’s regulatory powers including the power to issue infringement notices. The Bill lapsed at the end of the 46^th Parliament in July 2022. The NIAA advised the ANAO in May 2026 that it did not plan to seek amendments to the CATSI Act and that its priority was remaking the Corporations (Aboriginal and Torres Strait Islander) Regulations 2017 (CATSI Regulations), which will sunset in October 2027.

Corporations registered under the Corporations (Aboriginal and Torres Strait Islander) Act 2006

1.15 The CATSI Act classifies Indigenous corporations as small, medium or large (Figure 1.1).

Figure 1.1: Classification of small, medium and large Indigenous corporations

Source: Adapted from ORIC, Fact sheet: Corporation size and reporting, available from https://www.oric.gov.au/ [accessed 7 November 2025].

1.16 The total number of Indigenous corporations registered under the CATSI Act was 2,706 as at 30 June 2015 (Figure 1.2) and 3,284 as at 30 June 2025. The 3,284 corporations were led by 17,636 directors and comprised of 243,016 members and:

• 2,252 (69 per cent) were classified as small, 767 (23 per cent) were classified as medium and 265 (eight per cent) were classified as large;
• 1,312 (40 per cent) were registered charities; and
• 284 (nine per cent) were Registered Native Title Bodies Corporate.

1.17 ORIC began publishing data about individual corporations on the Australian Government’s central source of open government datasets data.gov.au in November 2021, which included the corporation size. Between November 2021 and November 2025, the proportion of Indigenous corporations classified as small declined from 74 to 69 per cent, medium increased from 20 to 23 per cent and large increased from six to eight per cent. In total, between November 2021 and November 2025, for the 2,662 corporations that were registered in November 2021 and still registered in November 2025, 309 changed size classification, with 242 of these corporations growing larger.

Figure 1.2: Indigenous corporations by size^a, 2014–15 to 2024–25

Note a: As at 30 June. Size is based on a corporation’s consolidated gross income, gross assets and number of employees, which can change over time. Due to a lack of reporting on size prior to November 2021, while total number of corporations shown in this graph is based on data from www.data.gov.au for all years shown, size classification was derived by the ANAO from the corporation’s most recent size classification in ORIC systems as at 30 September 2025 (including for de-registered corporations). As stated in paragraph 1.18, a small proportion of corporations change size over time, including some large and medium-sized corporations becoming smaller and some small corporations become larger. For these corporations, size classifications will not be accurate for all years shown in the graph.

Source: ANAO analysis of data from www.data.gov.au as at September 2025 and ORIC, State of the sector — January to June 2025, October 2025, available from https://www.oric.gov.au/corporations-and-registers/data-about-corporations/state-sector-reports [accessed 4 March 2026]. There are minor variations between the data published by ORIC and the data on www.data.gov.au.

1.18 The 3,284 corporations registered as at 30 June 2025 operated in the following major sectors²³: community services (33 per cent); education and training (27 per cent); health care and health promotion (20 per cent); heritage and culture (20 per cent); land and waters management (19 per cent); and employment (15 per cent). Indigenous corporations exist in all parts of Australia, with the largest number in Queensland (26 per cent), Western Australia (24 per cent) and the Northern Territory (20 per cent).

Corporation obligations under the Corporations (Aboriginal and Torres Strait Islander) Act 2006

1.19 Directors of Indigenous corporations have duties to act with reasonable care and diligence, act in good faith in the best interests of the corporation, not improperly use their position or information, disclose material personal interests, and not trade while insolvent.

1.20 The CATSI Act and Regulations require Indigenous corporations to:

• following the end of the reporting period, lodge reports within six months, which is usually by 31 December (unless exempted or extended) (Table 1.2);
• following the end of the corporation’s financial year, hold an annual general meeting within five months, which is usually by 30 November (unless exempted or extended);
• maintain up-to-date financial records and registers of members and former members;
• keep ORIC informed of relevant changes to the corporation; and
• follow rules set out in the corporation’s rule book, such as a dispute resolution process.

Table 1.2: Annual reporting requirements

Note a: A general report includes the names and addresses of members, directors, and contact person or secretary; total financial year income; total value of assets at year end; number of employees at year end; and whether any director, contact person or secretary is also an employee.

Note b: A financial report contains financial statements for the financial year, which must be audited.

Note c: Eligibility is that at least 90 per cent of income is from government funding; the corporation is required to lodge annual reports with funders as a condition of this funding; and the corporation is not required to provide consolidated financial statements.

Note d: A directors’ report contains a detailed overview of the corporation’s business performance over the year.

Source: ANAO based on ORIC, Fact sheet Corporation size and reporting, 2018, available from https://www.oric.gov.au/ [accessed 16 October 2025].

1.21 Compliance with lodging all required annual reports by December was 33 per cent for 2023–24 and 29 per cent for 2024–25 (see paragraph 4.42).

1.22 As at 30 June 2025 2,939 corporations were required to lodge annual reports for 2023–24. The 1,816 corporations that had lodged their 2023–24 general reports to ORIC by July 2025²⁴ reported $4.5 billion in revenue, $6.4 billion in assets and 22,687 employees.²⁵ Figures will underestimate total revenue, assets and employees due to late or non-reporting.

Rationale for undertaking the audit

1.23 Australian governments have stated that in a broad range of service delivery areas including health, housing and education, Aboriginal and Torres Strait Islander organisations achieve better results for their communities and should be empowered to make decisions about and deliver the critical services on the ground.²⁶ Corporations registered under the CATSI Act have billions of dollars in income and assets and employ tens of thousands of people. The NIAA states that Indigenous corporations ‘play a critical role in delivering services and supporting economic development in Indigenous communities, particularly in rural and remote Australia’.²⁷ The CATSI Act is a ‘special measure’ under the Racial Discrimination Act 1975 to give First Nations peoples access to the same opportunities to form and manage corporations as everyone else.²⁸

1.24 This audit provides assurance to the Parliament that ORIC is appropriately supporting and regulating Indigenous corporations to:

• meet the aims of the CATSI Act, which includes that First Nations peoples have access to the same opportunities to form and manage corporations as everyone else; and
• ensure that Indigenous corporations are well placed to deliver services and support economic development in Indigenous communities, particularly in remote Australia.²⁹

Audit approach

Audit objective, criteria and scope

1.25 The objective of the audit was to assess whether Indigenous corporations are being effectively supported and regulated under the CATSI Act.

1.26 To form a conclusion against the objective, the following high-level criteria were applied:

• Are there fit-for-purpose governance arrangements for the support and regulation of Indigenous corporations?
• Have Indigenous groups been effectively supported to incorporate and Indigenous corporations to operate in compliance with the CATSI Act?
• Have regulatory powers been used effectively to respond to, correct, penalise and deter non-compliance with the CATSI Act?

1.27 The audit focused on the period 1 July 2022 to 30 June 2025.

Audit methodology

1.28 The audit methodology included:

• analysis of ORIC and NIAA records and walkthroughs of ORIC systems and processes;
• meetings with regulators (Australian Charities and Not-for-profits Commission, Australian Securities and Investments Commission, Australian Taxation Office and National Native Title Tribunal), agencies that provide grant funding to Indigenous corporations (Department of Health, Disability and Ageing and NIAA) and stakeholders (Central Land Council, Australian Indigenous Governance Institute, Indigenous Business Australia and the office of the Commonwealth Director of Public Prosecutions);
• a survey of registered corporation representatives in October 2025, which received 207 responses³⁰; and
• reviewing two contributions to the audit from individuals involved with Indigenous corporations.

1.29 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $654,000.

1.30 The team members for this audit were Kai Swoboda, Mahkaila Sansom, Yoann Colin, Ewan McPherson, Lily Engelbrethsen, Tomislav Kesina and Christine Chalmers.

2.1 Resource Management Guide 128: Regulator Performance (RMG 128) establishes best practice principles for regulators. This includes:

• taking a risk-based approach to operational policy development, administration, compliance and enforcement activities, that is informed by data, evidence and intelligence;
• setting, actioning and reporting against expectations for regulatory functions and performance measures to provide transparency and accountability; and
• taking into account and responding to community expectations.³¹

Is there a fit-for-purpose regulatory framework?

Line management, committee arrangements and relationships with regulators

2.2 Implementation of the Registrar of Aboriginal and Torres Strait Islander Corporations’ (the Registrar) functions is supported by line management arrangements for ORIC’s 43 full-time equivalent staff (see Table 1.1), delegations and governance committees. The Registrar has established a delegation framework for various functions and powers. The Senior Management Group (SMG), which comprises 10 senior ORIC staff and the Registrar, is required to oversee and monitor ORIC’s regulatory approach. SMG terms of reference are dated 9 August 2022 and have not been revised to take account of February 2024 changes to the regulatory framework (see Table 2.1) and retain references to outdated ORIC documentation. The Regulatory Case Committee, which comprises four senior ORIC staff and the Registrar, is required to oversee ORIC’s response to matters of serious non-compliance. The terms of reference for the Regulatory Case Committee are dated 13 July 2023 and have also not been revised to take account of changes to the regulatory framework.

2.4 ORIC established memoranda of understanding (MOUs) with other regulators comprising the National Native Title Tribunal (18 May 2017); the Australian Securities and Investments Commission (ASIC) (24 August 2010); the Australian Charities and Not-for-profits Commission (ACNC) (3 June 2024); and the Australian Taxation Office (ATO) and Australian Business Registry Services (ABRS) (26 June 2024). The MOUs with ASIC and the National Native Title Tribunal are published on the ORIC website³² and the MOU with the ACNC is published on the ACNC’s website.³³ MOUs with the ACNC and ATO/ABRS are more detailed than those with ASIC and the National Native Title Tribunal about data sharing, meetings and regular review of MOUs. ORIC has exchanged data and met regularly with the ACNC, the ATO/ABRS, and National Native Title Tribunal. ORIC does not have scheduled, regular engagement with ASIC and engages on an ad hoc basis to discuss specific issues.

Regulatory framework

2.5 Table 2.1 shows the artefacts making up ORIC’s regulatory framework that were in effect and made publicly available between August 2021 and November 2025.

Table 2.1: Regulatory framework, as at November 2025

Note a: ORIC also developed for internal use 15 standard operating procedures and 27 system ‘task cards’ between May 2016 and November 2025.

Note b: As at November 2025: 01, Providing information advice and comment, June 2018. 04, Registration under the CATSI Act, March 2018. 05, The Registrar’s powers to intervene, 28 March 2017. 06, Change of corporation size, February 2013. 07, Exemptions, February 2013. 08, Corporation names, February 2013. 09, Member approval for related party benefits, February 2013. 10, Registered native title bodies corporate, 6 March 2025. 12, Registers and use and disclosure of information held by the Registrar, October 2019. 14, Review of reviewable decision, February 2013. 15, Privacy, January 2020. 16, Change to corporation details by telephone, email or Registrar’s initiative, January 2024. 17, Deregistration and reinstatements, February 2013. 18, Property of deregistered corporations, March 2024. 19, Transferring registration in and out of the CATSI Act, February 2013. 20, Special administrations, February 2017. 21, No-action letters, February 2013. 23, Review of fees charged by RNTBCs for certain native title functions, February 2013. 24, Applications for permission to deny a members’ request for a general meeting, February 2013. 25, Examinations, October 2016. 26, Compliance notices, 11 February 2013. 27, suspension of members and directors, 21 October 2013. 28, Additional or increased reporting requirements, March 2017. 29, Disqualified person and the Register of Disqualified Officers, October 2017. 30, Effect of invalid appointment of directors, 23 October 2018.

Note c: Extensions to annual general meeting and reporting deadlines, February 2024. Director terms, December 2024. Indigeneity, May 2025. Confidentiality of information provided to the Registrar, September 2025.

Note d: The five areas of regulatory action for 2024 were: reporting of assets and income; corporations providing housing or accommodation services; directors and officers meeting their duties; examinations with narrowed scope; and member rights.

Source: ANAO analysis of Regulatory compliance framework, Canberra, 2024, available from https://www.oric.gov.au/about-us/regulatory-approach [accessed 17 November 2025]; Registrar’s regulatory posture 2024, Canberra, 2024, available from https://webarchive.nla.gov.au/ [accessed 17 November 2025]; Registrar’s regulatory posture 2025, Canberra, 2025, available from https://www.oric.gov.au/about-us/regulatory-approach/registrars-regulatory-posture [accessed 17 November 2025].

2.6 ORIC’s Regulatory Compliance Framework and the Registrar’s Regulatory Posture do not incorporate references to the requirement for corporation directors, including of Indigenous corporations since November 2022, to have, or have applied for, a director identification number (see paragraph 4.15).³⁴

Ministerial statements of expectations and regulator statements of intent

2.7 RMG 128, issued by the Department of Finance in December 2022, states that ministerial statements of expectations are issued by the responsible Minister to a regulator or an entity with regulatory functions, to provide greater clarity about government policies and objectives relevant to the regulator’s statutory objectives and how it conducts its operations. The regulator responds with a Regulator Statement of Intent that identifies how it will deliver on the expectations. RMG 128 states that statements of expectations should be issued or refreshed every two years for all Commonwealth entities with regulatory functions, or earlier if there is a change in Minister, change in regulator leadership, or significant change in Commonwealth policy or objectives. Lack of up-to-date statements of expectation and intent makes it more difficult for the regulator to have clarity about government objectives and priorities and impairs transparency and accountability given the statements are meant to be publicly available and provide the basis for regulator performance reporting.³⁵

2.8 The Minister for Indigenous Affairs issued a statement of expectations to the Department of the Prime Minister and Cabinet (PM&C), to which PM&C responded, in 2017. In February 2021 the Minister for Indigenous Australians issued a statement of expectations to the Registrar which did not ‘anticipate’ a statement of intent, inconsistent with the requirements of RMG 128. As at November 2025, there was no contemporary statement of expectations or intent. This is not aligned with the requirement that statements are refreshed every two years or when there is a change in minister (which occurred in June 2022 and July 2024), or when there is a change in regulator leadership (which occurred in December 2021 and May 2022). In May 2025 the Registrar provided a draft statement of expectations and intent to the Minister for Indigenous Australians. As at May 2026 these had not been finalised.

Alignment with risk

2.11 RMG 128 states that risk-based and data-driven regulation means, in part, that regulators manage risks proportionately and that regulators leverage data and digital technology to identify risks.

2.12 In October and November 2022 ORIC prepared risk assessments for ‘environmental and strategic’, ‘corporate and operational’ and ‘regulated population’ risks. The five regulated population risks included: serious non-compliance or undetected fraud in Indigenous corporations (rated medium after controls applied); ‘[Chief Executive Officer (CEO)] burnout’ leading to corporation failure and loss of services to communities (high); Prescribed Bodies Corporate disputes³⁶ leading to loss of services to communities and impact on native title rights (high); and the failure to provide relevant services to Indigenous corporations that require them (medium). The risks were accepted with existing controls, except for the failure to provide relevant services to corporations. Additional treatments were developed for all the risks, regardless of their acceptance, which lowered the risk ratings to medium. Treatments included ORIC staff training, policy reviews, governance training, support to corporations, and timely prosecutions.

2.13 The three risk assessments were reconsidered in April to July 2023, at which time the regulated population risks and risk ratings identified in 2022 were retained.

2.14 In April 2025 ORIC adopted a ‘strategic risk framework’, which replaced the previous approach and states that it is used to guide ORIC’s administration of the CATSI Act, priority setting and operational decisions. The framework again categorised risks in three areas: ‘environmental’; to ORIC’s operations; and to Indigenous corporations. The framework listed risks, sources and treatments. A September 2025 assessment listed seven risks to Indigenous corporations, which comprised serious non-compliance, inaccuracy of the public register, CEO performance expectations, corporation disputes, issues outside of ORIC’s jurisdiction (which included underperforming or corrupt CEOs), failure to provide relevant support, and adopting a digital first approach. Risk sources and 17 treatments were listed. While an introduction to the ‘strategic risk framework’ states that ORIC considers controls, likelihood, consequences, risk ratings, risk acceptance authority, due dates, and accountable officers, the September 2025 framework did not identify controls, assess the risks, indicate tolerance levels, state whether the risks were accepted, or assign treatment owners.

2.15 Element two of the Commonwealth Risk Management Policy states that an entity’s risk management framework should include a risk appetite statement supported by risk tolerance statements. These establish the overarching amount and types of risk an entity is willing to accept in order to achieve its objectives and, combined with risk ratings, help entities prioritise activities to achieve objectives in a resource-constrained environment. Element four of the Commonwealth Risk Management Policy states that responsibility for managing risks should be clearly defined and should include at a minimum control and treatment owners. Establishing owners creates accountability for implementing and monitoring the effectiveness of controls and treatments. Element five is that the controls must be periodically reviewed.

2.16 RMG 128 states that:

Strategic management of risk can also improve efficiency by prioritising resources to the areas of highest risk, and increase compliance by focusing limited resources on the areas of the greatest risk of non-compliance. It can also reduce the overall compliance and cost burden by minimising government intervention where the risks are relatively low.^.37

2.17 ORIC’s regulatory framework describes its approach as ‘proportionate’ to the nature of the non-compliance and potential for harm. The ‘proportionate’ approach intends that:

• corporations are given the opportunity to resolve lower-risk compliance matters themselves without the need for regulatory action;
• the risk of harm to the corporation, members or stakeholders is minimised;
• when responding to non-compliance, the Registrar takes into account whether the corporation has the capacity to resolve the issues itself and if other avenues of support, guidance, and direction from ORIC have not been successful; and
• regulatory intervention is considered for corporations with a history of intentionally providing incomplete or inaccurate information and that: ignore or do not meet statutory timelines for routine requirements, do not respond to ORIC’s efforts to engage them, disregard the mandate of members, do not cooperate and fix non-compliance after being given the opportunity to do so, and demonstrate wilful or deliberate non-compliance.

2.18 The February 2024 Compliance Framework includes a ‘response continuum’, which specifies actions ranging from providing help and support where a corporation is committed to doing the right thing (described as low risk) through to enforcement action and deterrence where there is deliberate non-compliance (described as high risk).

2.19 The Compliance Framework does not explicitly refer to the specific regulated population risks identified in 2022 or 2023, and has not been updated since February 2024 to reflect the April 2025 ‘strategic risk framework’. There is no direct line of sight between the risk assessments in the strategic risk framework and the Compliance Framework, in that the same words and structure are not re-used and there is no prioritisation in the Compliance Framework that is consistent with the risk ratings. The Compliance Framework does not draw any links to data or evidence. The ANAO determined that the Compliance Framework indirectly addresses the key risks or risk treatments identified in 2022 and 2023, in that the Compliance Framework discusses issues that are broadly related to the identified risks and treatments.

2.20 Informed by business group reporting, the SMG considered drafts of the Registrar’s Regulatory Posture (which includes regulatory priorities and focus areas) in July 2023, September 2023, October 2023 and February 2024. In February 2024 the SMG was advised that focus areas were either key responsibilities under the CATSI Act or ‘based on identified trends and risks’ but that there was a risk that ‘[s]horter term focus areas do not represent [the] most significant risks to ORIC’. The five focus areas were presented without a specific risk-based rationale explicitly linked to the risks to corporations identified in 2022 and 2023 assessments, and there was no explicit link made to data and evidence. The update to the Registrar’s Regulatory Posture in February 2025 also did not include these explicit links, however it was updated after consideration by the SMG in December 2024 and February 2025, and review by ORIC managers.³⁸

2.21 Element seven of the Commonwealth Risk Management Policy is that entities must implement arrangements for identifying, managing and escalating emerging risks and element nine is that an entity’s risk management approach must be regularly reviewed, to ensure that the approach and controls are relevant, effective, address emerging risks, and address changes in the entity’s operating environment. After its establishment in April 2025, ORIC reviewed the ‘strategic risk framework’ in June 2025, September 2025 and February 2026. The next review of the ‘strategic risk framework’ by the SMG is due in June 2026.

Focus on cost-effectiveness and regulatory burden

2.26 Aims established for the Registrar in the CATSI Act include facilitating and improving the efficiency and sustainability of Indigenous corporations; and administering functions and powers with a minimum of procedural requirements (see paragraph 1.8).³⁹ RMG 128 states that:

The Government expects regulators to weigh the efficiency and cost-effectiveness of their regulatory actions, seeking to impose the least burden on those that are regulated while maintaining essential safeguards.

2.27 In May 2023 ORIC commissioned research from Ernst & Young on the compliance costs for Indigenous corporations.⁴⁰ The purpose of the research was to analyse costs associated with CATSI Act compliance requirements such as holding annual general meetings and reporting, and compare compliance costs under the CATSI Act and Corporations Act 2001 (Corporations Act). The final report was provided to ORIC in August 2025. ORIC advised the ANAO in January 2026 that the study was complex and, consequently, took longer than expected to complete. Ernst & Young found that, based on its assumptions and methodology, it was generally less expensive to operate under the Corporations Act than the CATSI Act. ORIC advised the ANAO in October 2025 that it did not agree with all of the assumptions and was considering further work.

2.28 The Compliance Framework does not include consideration of regulatory cost and burden despite this being an aim for the Registrar under the CATSI Act. ORIC has established priorities and deliverables in its 2024–2027 ‘corporate plan’ aimed at reducing burden, including a new website portal in March 2025 that included ‘straight through processing’ of corporate information⁴¹ and pre-populated general reports. Arrangements with the ACNC provide that registered charities also registered under the CATSI Act do not need to update their information on the ACNC register. In lieu of standard reporting obligations, ORIC will accept reporting provided to funding bodies in certain circumstances (see Table 1.2).

2.29 An ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28) examined corporations’ views about how ORIC has delivered against the aims established for the Registrar in the CATSI Act and demonstration of regulator best practice principles established in RMG 128. The survey found:

• 56 per cent agreed that the Registrar’s/ORIC’s support and regulatory activities have regard to Aboriginal and Torres Strait Islander tradition and circumstances and 23 per cent disagreed;
• 56 per cent agreed that the Registrar/ORIC facilitates the efficiency of Aboriginal and Torres Strait Islander corporations and 26 per cent disagreed;
• 55 per cent agreed that the Registrar’s/ORIC’s support and regulatory activities are administered with a minimum of procedural requirements and 20 per cent disagreed;
• 53 per cent agreed that the Registrar/ORIC facilitates the sustainability of Aboriginal and Torres Strait Islander corporations and 24 per cent disagreed;
• 53 per cent agreed that ORIC demonstrate managing risks proportionately and maintaining essential safeguards while minimising regulatory burden and 24 per cent disagreed; and
• 53 per cent agreed that the Registrar/ORIC facilitates the effectiveness of Aboriginal and Torress Strait Islander corporations and 27 per cent disagreed.

2.30 Themes raised by the minority of respondents who disagreed that ORIC has effectively delivered against the aims established for the Registrar included concerns about a perceived lack of responsiveness to non-compliance; a perceived lack of respect for traditional culture; regulatory burden; and perceived poor usability and quality of systems.

2.31 Across the full survey, respondents from smaller corporations registered in New South Wales and operating in the arts, community services, health and agriculture sectors tended to be more positive about ORIC’s performance, while respondents from medium to large-sized corporations, Registered Native Title Bodies Corporate, corporations providing land and water management and corporations registered in South Australia and Western Australia tended to be less positive.

Is there effective monitoring and reporting on whether regulatory aims are being achieved?

Public performance reporting through a corporate plan

2.32 As stated at paragraph 1.7, as the accountable authority for ORIC, the NIAA CEO has duties under the PGPA Act in relation to ORIC, including, under section 19, to keep the responsible Minister and Minister for Finance informed about the entity and its activities and to observe and consider rules and guidance under the PGPA Act framework, which give effect to the PGPA Act. This includes the Commonwealth Procurement Rules, Commonwealth Grant Rules and Principles, and Department of Finance resource management guides such as RMG 128 Regulator Performance and RMG 131 Developing performance measures. RMG 128 states that regulators are expected to be consistent with the Regulatory Policy, Practice and Performance Framework and should refer to RMG 128 for guidance. RMG 128 applies to all Commonwealth entities that perform regulatory functions, including both standalone regulators and those located within departments.

2.33 Entities that perform regulatory functions should consider developing performance measures for these functions and publicly report performance results through corporate plans.⁴² RMG 128 states:

As better practice, regulator performance reporting can be incorporated into an entity’s non-financial corporate reporting to provide transparency and accountability. Where there are established performance measures set out in the corporate plan that relate to regulatory activities, these are reported on in the annual performance statements. This supports transparency and accountability of regulator performance by requiring the inclusion of this information in a consistent location for all regulators, and in reports subject to the scrutiny of the Parliament and the Auditor General. It also reduces duplication in regulator performance reporting.

2.34 The regulator performance reporting requirements are principles based. RMG 128 states that it applies to PGPA Act ‘entities and companies’ that perform regulatory functions and does not explicitly contemplate statutory office holders or bodies separately established within entities. Nonetheless RMG 128 states that ‘regulatory functions are exercised across a range of government arrangements and structures’, refers to regulation as ‘any rule endorsed by government where there is an expectation of compliance’, assumes that regulators would publish a corporate plan as defined in Part 2–3 of the PGPA Act, and promotes principles and requirements that are designed to improve accountability and transparency of regulator performance.

2.35 RMG 128 advises regulators to refer to RMG 131 Developing performance measures for guidance on designing and reporting performance measures.⁴³ As a non-corporate Commonwealth entity, the NIAA must comply with the PGPA Act by including annual performance statements in annual reports that are consistent with the requirements and RMG 131 guidance.⁴⁴ The PGPA Act does not require ORIC to develop its own corporate plan as it is not a listed entity.⁴⁵

2.36 As a regulator of over 3,000 corporations with billions of dollars in income and assets and employing tens of thousands of people, some of which provide essential services to communities, public transparency on ORIC’s performance through a corporate plan and performance statement is important and aligned with the principles of RMG 128.

2.37 While the NIAA has included some statistical information on ORIC’s activities in an appendix to its annual reports since the NIAA was established in 2019⁴⁶, the NIAA’s corporate plans and annual performance statements do not include any performance measures for ORIC. The NIAA advised the ANAO that it did not consider the functions of ORIC as sufficiently material to include in its annual performance statements. Lack of reporting is not consistent with the principle of transparency and accountability for regulator performance established in the Regulatory Policy, Practice and Performance Framework.

2.38 ORIC advised the ANAO in December 2025 that, in the interests of being transparent and accountable, it publishes a ‘corporate plan’ and publicly reports on its performance despite not being required to do so.

2.41 More generally, Auditor-General Report No. 22 of 2025–26 Performance Statements of Major Australian Government Entities — Outcomes from the 2024–25 Audit Program stated that:

The 2024–25 audits identified a potential gap regarding whether, and in what manner, PGPA Act entities should report on the functions of such statutory authorities and office holders. This is particularly relevant for measuring and assessing the achievement of an entity’s purposes, given that many such authorities or office holders have separate reporting obligations outside the PGPA Act, while the accountable authority of the PGPA Act entity remains responsible for performance reporting under the Act.

2.44 Between 2006–07 and 2024–25, ORIC has publicly reported on its performance in different ways.

• Between 2006–07 and 2022–23, ORIC published a ‘yearbook’ that included performance information.
• ORIC’s 2021–2024 ‘corporate plan’ (published August 2021) included six performance measures. Results for the measures were not reported.
• The ORIC 2024–2027 ‘corporate plan’ listed 45 ‘deliverables’ and 86 unique⁴⁷ performance measures, which it intended to report on publicly through three performance reports each year: ‘what ORIC has achieved’ (November); ‘the impact of ORIC’s work’ (February); and ‘how well ORIC is performing’ (July).
• ORIC published reports in November 2024, February 2025, July 2025 and November 2025, in accordance with its stated intention.⁴⁸ The four reports relating to November 2024 to November 2025 reported results for 65 of 86 performance measures established in the ‘corporate plan’ (or of 80 excluding measures that related to initiatives that had not yet been implemented, such as an online training module).⁴⁹ Of 43 ‘pathway deliverables’ due to be completed by July 2025, completion or ongoing progress was reported for 33.

2.45 ORIC publishes substantial information about the Indigenous corporations it regulates. There is a public register, as required under the CATSI Act, of registered and deregistered corporations.⁵⁰ Since November 2021, ORIC has published information about Indigenous corporations on www.data.gov.au.⁵¹ ORIC publishes on its website and updates on a daily basis a searchable list of corporations that have not lodged all required reports (see Table 1.2) for the two previous financial years.⁵² Between July 2011 and January 2025, ORIC published detailed information on its website about ‘complaints’ or ‘reports of concern’ about Indigenous corporations. In October 2025, ORIC published its first ‘State of the Sector’ report, which included limited (compared to previous reporting) report of concern data.⁵³ ORIC advised the ANAO in December 2025 that the previous, more detailed, reporting did not attract a large amount of traffic or engagement and that it had reprioritised its effort to more meaningful materials that are expected to be of more value to Indigenous corporations.

2.46 Since 1 July 2022 ORIC has prepared 11 ministerial briefs and submissions. ORIC reported on its performance to the Minister in an incoming Ministers brief (May 2025), which included a list of activities that ORIC had completed since the most recent Registrar was appointed. Of the 10 other briefs and submissions, nine were about individual corporations that had been brought to the attention of the Minister by ORIC or members of the public and one was related to proposed changes to the CATSI Act.

Quality of publicly reported performance information

2.47 For entities that are not required to publicly report performance results, the guidance in RMG 131 provides better practice principles for good performance reporting.

2.48 Publicly reported performance measures, which are typically expressed at a high level, should be supported in the entity by more detailed methodological information that explains how performance data is sourced, how concepts are defined, the time period at which data is extracted, how calculations are derived, what data points are considered in or out of scope, and any data assurance processes. Documented methodological information supports efficient processes; consistency in analysis, interpretation and reporting; transparency, including over a measure’s reliability and possible biases; and business continuity. Each pathway deliverable listed in the ORIC 2024–2027 ‘corporate plan’ had a named owner and each performance measure had a named owner, general data source (‘CRM’, ‘manual records’ ‘corporation survey’, website, anecdotal evidence, ‘reports’ among others) and data owner, however in most instances the methodological information was not detailed enough to support the objectives of methodological documentation described above, including due to a lack of a documented calculation methodology.

2.49 Noting that further methodological information may have led to a different classification, the ANAO preliminarily assessed that the ORIC 2024–2027 ‘corporate plan’ measures represented a mix of qualitative (12) and quantitative (74) measures; and a mix of input (3), activity (9), output (51), outcome/effectiveness (13) and timeliness (5) measures.⁵⁴ There were no efficiency measures that linked performance information to financial information. The measures were linked to three ‘pathways’ ‘to achieve trust and confidence in Aboriginal and Torres Strait Islander corporations, and become a regulator of choice’. The greater emphasis on outcomes represents an improvement over the approach of the ORIC 2021–2024 ‘corporate plan’, which largely related to activities that ORIC intended to undertake.⁵⁵ There is a basis for assessment over time for 85 of the measures, if measured in a consistent manner. However, the large volume of measures, each of which are intended to be publicly reported, may obscure a clear performance story.

2.50 RMG 131 states that ‘Targets for each performance measure should be provided in the corporate plan where it is reasonably practicable to set a target’ and outlines two situations where it would not be reasonably practicable: data is not available or is difficult to establish, or a baseline is being developed. In the absence of a target, it is unclear to a reader what is considered good performance or how actual performance aligns with expectations. It would be reasonably practicable to have a target based on historical data or expected performance for 74⁵⁶ of the 86 measures. Of the 74 measures, one had a numeric and specific target (reports of concern are responded to within 20 days unless ‘complex’), and four had a general target such as ‘year on year improvement or reduction’.

2.52 Under its terms of reference, the SMG is required to oversee and assure ORIC’s performance framework and monitor its internal and external performance. The SMG had input into a revised internal performance framework in 2022 and considered business area performance at most of its 44 minuted meetings held between July 2022 and September 2025.⁵⁷

Are there efforts to build trust and continuously improve?

Accountability processes

2.53 RMG 128 states that, in practical terms, a commitment to continuous improvement and building trust means regulators have transparent external accountability processes encouraging procedural fairness, accessibility and responsiveness; and actively engage with stakeholders to identify solutions to avoid or reduce unnecessary costs.⁵⁸ The Australian Government’s Charter of Partnerships and Engagement states that good engagement practice includes identifying how groups and individuals may differ in their level of influence, interest and needs and undertaking stakeholder mapping to clarify who to engage with and how best to engage.⁵⁹ ORIC stakeholders could include Indigenous corporations, local communities, peak bodies, funding bodies, other Commonwealth entities that engage with Indigenous corporations and other regulators.

Stakeholder engagement

2.54 ORIC has not mapped its stakeholders and does not have a stakeholder engagement plan. ORIC advised the ANAO in June 2025 that it engages with stakeholders ‘as required’.

2.56 ORIC has several ongoing stakeholder engagement arrangements, including an annual survey of corporations since 2024 and annual training survey since 2020, the MOUs with other regulators described in paragraph 2.4, quarterly meetings since April 2024 with the Office of the Commonwealth Director of Public Prosecutions, and monthly meetings since March 2025 with the ATO/Australian Business Registry Services.

2.57 There is evidence of other ad hoc stakeholder engagement. For example, ORIC consulted with the Australian Institute of Company Directors and Australian Indigenous Governance Institute on its ‘corporate governance principles’ in 2022 and with five regulated corporations to seek stakeholder input into IT system redevelopment in 2024.⁶⁰ It met on an ad hoc basis with the ACNC from 2023. ORIC is a member of the National Regulators Community of Practice (NRCoP)⁶¹ and the Fraud Fusion Taskforce.⁶²

2.58 In an ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28): the majority of survey respondents agreed that ORIC demonstrates the RMG 128 regulator best practice principles of communicating transparently and responsively (63 per cent agreed and 20 per cent disagreed); and implementing regulations in a modern and collaborative way (56 per cent agreed and 21 per cent disagreed). Corporations agreeing that ORIC demonstrates this principle stated that ORIC was ‘helpful’ and ‘communicate well’. Several themes raised by respondents disagreeing related to a perceived lack of clarity in communications and cultural competency. For example, one corporation stated that: ‘Whilst training for Directors offered by ORIC and its partners is well done it is not suitable for those Indigenous Directors who don’t read or speak English well’.

Accountability mechanisms

2.59 ORIC has established accountability mechanisms, including a Customer Service Charter (November 2016, last revised May 2025) and Protocol (February 2024); a complaints channel; and standard operating procedures (November 2024, updated October 2025) and a framework (April 2025) for handling complaints about staff. Data on the number of complaints made about ORIC staff was published in ORIC yearbooks until 2022–23 (see paragraph 2.44). The three complaints reported in 2022–23 related to a lack of timeliness and professionalism. ORIC advised the ANAO in September 2025 that in 2023–24 and 2024–25 it received 11 complaints about staff, of which one was substantiated (this related to disclosure of a conflict of interest).

Right of review

2.60 The CATSI Act lists 50 decisions by the Registrar that may be subject to an internal review if requested by a person whose interests are affected by the decision. Letters provided to corporations subject to a decision sometimes refer to the right to request a review. ORIC established a Policy Statement in August 2009, which was last revised in February 2013, that provides guidance on ORIC’s internal review processes.⁶³

2.61 ORIC advised the ANAO in September 2025 that it was not able to provide the number of internal reviews undertaken over time without manual effort, due to limitations of its previous client relationship management system. Between 27 March 2025 (when a new system was introduced) and 8 October 2025, ORIC recorded 13 requests for internal reviews. Of the 13 requests, as at November 2025 three were approved, two were refused, three were withdrawn, two had ‘resolved’, and three (requested in May, June and August 2025) were yet to be addressed. ORIC does not publicly report on internal reviews, have a standard operating procedure or guidance, or analyse themes for the purpose of continuous improvement.

2.62 An ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28) examined corporations’ views about how ORIC delivers on elements of its Compliance Framework and Registrar’s Regulatory Posture. In total, 57 per cent of survey respondents agreed that the Registrar/ORIC advises corporations about their review, appeal and complaints rights and 13 per cent disagreed; and 56 per cent agreed that the Registrar/ORIC acts independently and impartially and 17 per cent disagreed. Several themes raised by respondents on this issue related to high quality communication (‘really good communication’), high transparency (‘transparent and accountable of all corporations and individuals’), lack of follow through (‘ORIC advises of review, appeals and complaints rights, but appears not to follow through’) and lack of consistency in decision-making (‘Staff play favourites to certain organisations if they have worked with them before in other capacities’).

Improving performance

2.64 RMG 128 recommends holding rigorous ex-post reviews of regulatory actions to identify learnings and explore opportunities for improvement.⁶⁴ RMG 128 sets out that a commitment to continuous improvement and building trust means regulators undertake regular and independent performance reviews, including regular reviews of operating procedures.⁶⁵

2.65 ORIC has undertaken a number of in-house and commissioned reviews and assessments of its support and regulation activities and business processes, including ex-post reviews of examinations (See Appendix 4). The Registrar has a function under the CATSI Act to conduct research in relation to matters affecting Aboriginal and Torres Strait Islander corporations. In June 2020 ORIC commissioned research from the University of Queensland⁶⁶ (published by the University of Queensland in July 2022)⁶⁷ about the factors that contribute to Indigenous corporation success beyond formal and corporate modes of governance; and how ORIC could best support the operationalisation of informal factors. In early 2024, ORIC considered how themes from the research could be applied to its regulatory framework and activities.

2.66 The ANAO observed a number of improvements made to business operations between February 2024 and September 2025, including the publication of Position Statements; providing tailored support to new corporations; determining that it would no longer accept general reports that have blank values for financial information or count these as ‘compliant’⁶⁸; revising its approach to reports of concern and dispute management; implementing a new client relationship management system and online reporting portals for corporations; and implementing changes to examination and special administration processes (see also Appendix 2).

2.67 An ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28) examined corporations’ views about ORIC’s application of regulator best practice principles established in RMG 128 and found: 56 per cent agreed that ORIC is continuously improving its performance, capability and culture and 23 per cent disagreed; 56 per cent agreed that ORIC is leveraging data and digital technology to support those it regulates to comply and 21 per cent disagreed; and 49 per cent agreed that ORIC is adopting a whole-of-system perspective and 21 per cent disagreed. Key themes raised by respondents on this issue related to: quality and timeliness of support provided to corporations; continuous improvement, and cultural competency and sensitivity, with mixed views across the themes.

3.1 The CATSI Act preamble provides that the Act is a special measure for the advancement and protection of Aboriginal and Torres Strait Islander peoples under the International Convention on the Elimination of All Forms of Racial Discrimination and the Racial Discrimination Act 1975.⁶⁹ The Registrar has a function under the CATSI Act to conduct public education programs on the operation of the CATSI Act.⁷⁰ Resource Management Guide 128 Regulator Performance (RMG 128) states that best practice regulators ‘provide guidance and information that is relevant, clear, concise and easily accessible to help regulated entities understand their obligations and responsibilities to encourage voluntary compliance’.⁷¹

Is there a strategic approach to support and education?

Strategic planning

3.2 ORIC developed a ‘communications plan’ for January to June 2024 that stated:

We create and share information, tools and stories that help Aboriginal and Torres Strait Islander corporations meet their compliance obligations, govern effectively and evolve their governance standards.

The communications plan included goals, principles, channels, audiences, regulatory priorities, how ORIC’s communications will support ORIC’s regulatory focus areas and activities with goals and due dates. As at November 2025, of the 36 total activities contained in the plan, two were ongoing, 30 were completed (of which, 15 on schedule), and four were not progressed.

3.3 There was no similar comprehensive and outcomes-focused plan for any other time period. There were planning documents demonstrating elements of communications planning, such as communications ‘schedules’ (which since the introduction of the Registrar’s Regulatory Posture in 2024 included consideration of focus areas), communications plans for specific projects⁷², and a business plan for the Education and Communications section within ORIC.

3.4 The Department of Finance’s Regulatory Policy, Practice and Performance Framework states that communication and education strategies should be aligned with user preferences, habits, behaviours and accessibility needs.⁷³ ORIC collected data on its email delivery performance, website and social media analytics, and feedback from corporations through a 2024 survey. ORIC used this information to identify potential improvements in communications activities.

3.5 In October and November 2025, the ANAO undertook an online survey of Indigenous corporations (see paragraph 1.28). ORIC’s list of 3,298 contact persons and corporation secretaries had contact details for 1,033 (31 per cent) that were duplicated, incomplete or faulty. Memoranda of understanding with the Australian Taxation Office (ATO) and the Australian Charities and Not-for-profits Commission (ACNC) state that the entities will exchange information to, in part, allow ORIC to ‘enhance record keeping arrangements by supporting corporations to improve and update the data held by the Registrar’ and to ensure ACNC Register ‘data is kept accurate’. In 2024 and 2025, ORIC undertook activities with corporations to improve contact details. In February 2026, ORIC developed a new email policy and revised standard operating procedures to include a check of directors’ details. ORIC advised the ANAO in February 2026 that a telephone campaign would be considered in March 2026.

3.6 ORIC does not have a strategic plan that establishes priorities for education and training activities and financial support, however ORIC has published goals on its website including improving directors’ skills and improving governance and management in developing sectors. ORIC collects information on training preferences through an annual survey of Indigenous corporations and advised the ANAO in December 2025 that the training schedule is also informed through ‘experience and knowledge on demand, interest, registrations and attendance for the past couple of years’. The training schedules were developed in consultation with the managers of ORIC regional offices (2023–24 and 2025–26) and the Senior Management Group (2024–25).

Support to incorporate

3.8 The number of new corporations voluntarily registered under the CATSI Act averaged 167 each year over the 10 years to 2024–25 and was at its highest level in 2023–24 (199) and lowest in 2024–25 (144).

3.9 There are specific benefits to incorporating under the CATSI Act. ORIC provides general guidance to the community about the CATSI Act (including the benefits, checklists and templates such as model rule books) and responds to inquiries about incorporation. ORIC’s inquiry service (see paragraph 3.17) ‘resolved’⁷⁴ 723 inquiries about registration between 1 July 2022 and 30 June 2025. Of these inquiries, 82 per cent were ‘resolved’ in one day or less. ORIC’s LawHelp service was expanded in 2014 to allow Indigenous organisations not registered under the CATSI Act to be eligible for legal assistance with the process of registering (see Table 3.2). ORIC describes a ‘pre-incorporation doorway service’ (in-person workshop) on its website. ORIC considered and/or responded to seven pre-incorporation requests over 2022–23, 2023–24 and 2024–25, however did not deliver any pre-incorporation workshops in 2022–23, 2023–24 or 2024–25.

3.10 ORIC’s ‘customer service charter’ that was in place from November 2016 until early 2024 had definitions of ‘customer’ that broadly included Aboriginal and Torres Strait Islander individuals and groups. A revised customer service charter published in early 2024 did not incorporate a definition of customer and a May 2025 version more narrowly defined a customer as ‘any person who has direct contact or a commercial relationship with ORIC, including our stakeholders with whom we interact regularly’.

3.11 Under the Indigenous Advancement Strategy (IAS)⁷⁵ grant opportunity guidelines, organisations receiving IAS grants of $500,000 or more in a financial year are required to incorporate under Commonwealth legislation.⁷⁶ To assist organisations required to transfer their incorporation status to Commonwealth legislation, the National Indigenous Australians Agency (NIAA) provides a one-off $10,000 payment. The NIAA advised the ANAO in October 2025 that while it administers a range of activities and programs aimed at supporting governance and expanding economic opportunity, its programs are not aimed specifically at encouraging incorporation under the CATSI Act, and in December 2025 that promotion of incorporation under the CATSI Act is beyond the scope of the Executive Order establishing the entity.

3.12 In an ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28): 61 per cent agreed that ORIC was helpful to their organisation to assist them to incorporate under the CATSI Act and nine per cent disagreed; and 55 per cent agreed that ORIC was helpful in making their organisation aware of the benefits of incorporation and 14 per cent disagreed. While most survey commentary relating to this aspect of ORIC’s performance was positive, several comments described unexpected burden associated with CATSI Act incorporation; or a perceived lack of understanding of cultural and accessibility needs, impacting on ‘practical comprehension and informed decision-making’.

Guidance materials to support compliance

3.14 ORIC has developed a suite of guidance materials to assist Indigenous corporations to comply with their obligations under the CATSI Act, including factsheets, templates, booklets, forms, guides and videos. ORIC provides guidance through four channels: website; direct emails to corporations and directors; social media campaigns; and telephone campaigns. As at November 2025, ORIC had published 127 different guidance materials on its website. ORIC advised the ANAO in June 2025 that it also provides guidance materials at in-person training and events.

3.15 ORIC received $5.3 million over three years to 2024–25 for a project to implement guidance and IT changes associated with the introduction of director identification (ID) requirements (see paragraph 4.17).⁷⁷ ORIC advised the ANAO in May 2026 that expenditure was not tracked at the whole new policy proposal level and was split across multiple project codes and cost centres, which included other sources of funding. This meant that it could not provide a reconciliation of funding at the whole of measure level.

Advice and support services

3.16 ORIC had a Policy Statement that outlines the Registrar’s statutory function in providing advice, including the kinds of advice they will provide and to whom.⁷⁸ The Policy Statement was retired on 14 January 2026 and was replaced with website content.⁷⁹

3.17 Advice is provided in response to general inquiries received through emails, telephone calls, online system submissions or in-person presentations to ORIC. There are standard operating procedures for managing general inquiries. The 2022–23 Yearbook stated that ORIC received 16,168 calls in 2022–23 (of which it reported that it answered 40.3 per cent); the 2023–24 Annual Report stated that it received 11,448 calls in 2023–24 (with no information provided about answer rate); and the July 2025 performance report stated that it received 11,900 calls in 2024–25 (of which it reported that it answered 81.1 per cent). An internal business plan dated February 2024 stated the target for answering calls was 80 per cent. ORIC advised the ANAO in December 2025 that unanswered calls comprised calls received after hours or which were, during business hours, diverted to voicemail or disconnected by the caller.

3.18 Over the three years to 30 June 2025, ORIC ‘resolved’ 21,331 inquiries in its client relationship management system. The Policy Statement indicated that ORIC aimed to provide a response to all requests for ‘information’ within one week and all requests for ‘advice’ within one month. In practice ORIC did not differentiate in its client relationship management system between information and advice and was therefore not able to monitor its performance against these service standards. The service standards were retired with the Policy Statement in January 2026. A new client relationship management system introduced in 2025 includes some functionality to identify matters outside of specified timeframes. The ANAO calculated that approximately two-thirds of inquiries (for ‘information’ and ‘advice’ combined) were responded to within one day in each year between 2022–23 and 2024–25 and that the average time taken by ORIC to resolve inquiries was six working days in 2022–23 and four working days in 2024–25 (see Table 3.1).

Table 3.1: Time taken to ‘resolve’ inquiries, 2022–23 to 2024–25^a

Note a: Of the 21,331 resolved inquiries, 2,938 were not associated with a specific Indigenous corporation in the data. The remaining 18,393 inquiries came from 3,098 different Indigenous corporations. Of these, 812 corporations had one inquiry and the balance had made two and 132 inquiries over the period.

Note b: Public holidays were not removed from the number of working days.

Source: ANAO analysis of ORIC inquiry data.

3.19 In addition to general advice channels, four specialised support services were operational between 1 July 2022 and 30 June 2025 (Table 3.2).⁸⁰ Of the four support services listed in Table 3.2, as at November 2025, one (ORIC Recruitment Assistance) had been disbanded.

Table 3.2: Support services, 2022–23 to 2024–25

Note a: Office of the Registrar of Indigenous corporations (ORIC), Corporation jobs, available from https://www.oric.gov.au/learning-and-support/corporation-jobs [accessed 25 November 2025].

Note b: Office of the Registrar of Indigenous corporations (ORIC), LawHelp, available form https://www.oric.gov.au/learning-and-support/lawhelp [accessed 25 November 2025].

Note c: For one record it is not clear whether the corporation was contacted by email or telephone.

Source: ANAO analysis.

3.21 In an ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28), 67 per cent of survey respondents agreed that ORIC provides helpful advice and guidance about the registration, management and operation of Indigenous corporations and 15 per cent disagreed. Positive survey commentary referred to responsiveness, helpfulness, promptness and courteousness. Several themes raised by survey respondents who disagreed related to a perceived lack of staff understanding of the Registrar’s powers, including in relation to Registered Native Title Bodies Corporate; inconsistent advice; poor responsiveness; and limited regard for cultural and individual circumstances.

Training and education

3.22 The February 2024 Compliance Framework identified training and education as a form of support to enable corporations to identify and rectify non-compliance with CATSI Act obligations. ORIC cannot compel a corporation’s members or directors to undertake training.

3.23 ORIC offers six types of training to members and directors of Indigenous corporations, ranging from self-paced online learning expected to be delivered from July 2026, to customised in-person workshops and a Certificate IV in Aboriginal and Torres Strait Islander governance. There is an annual training schedule, which identifies the type and locations of training activities to be held each year. ORIC has largely delivered non-customised training in accordance with its annual schedule and, according to ORIC data and website publications, delivered more than planned in each year (32 sessions in 2022–23, 55 in 2023–24 and 61 in 2024–25).

3.24 ORIC may provide financial support for directors of small corporations to attend training that is more than 100 kilometres away. ORIC spent $43,014 in 2022–23, $23,493 in 2023–24 and $103,322 in 2024–25 supporting attendance at training events, with approximately 230 requests assessed for eligibility in 2022–23 and 2023–24 and approximately 130 assessed for eligibility in 2024–25.

3.25 The November 2024 ORIC performance report stated that it reminds new corporations of training and targets training to corporations leaving special administration (see Box 1). While there is evidence of ORIC promoting training to new corporations through its tailored support for new corporations service (Table 3.2) and new corporation factsheet, offers and delivery of training to corporations leaving special administration were uneven in the period between July 2022 and October 2025. Of nine corporations leaving special administration between 1 July 2022 and 19 September 2025, four were offered training (one offer of which was accepted) and two received training. The end of special administration template sent to directors was amended in April 2026 to include an offer of training.

3.26 ORIC’s website states that it offers customised training that is tailored for specific groups or corporations. ORIC delivered 57 per cent of requested customised training sessions in 2022–23, 21 per cent in 2023–24 and 21 per cent in 2024–25 (Table 3.3). ORIC advised the ANAO in September 2025 that requests for customised training may be referred to an already planned workshop depending on whether the corporation is subject to regulatory action, ORIC’s resourcing, corporation remoteness, and the corporation’s commitment to attend.

Table 3.3: Number of customised training sessions requested and delivered, 2022–23 to 2024–25^a

Note a: Customised training sessions include corporation specific training, pre-incorporation workshops and rulebook design workshops. The ANAO has assumed that delivered training was requested.

Source: ANAO analysis of ORIC data.

3.27 In an ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28), 66 per cent of survey respondents agreed that ORIC provides helpful education and training to Indigenous corporations and 14 per cent disagreed. Several themes raised by respondents who disagreed related to the mode or location of delivery; a perceived lack of cultural appropriateness or range of training content; and the amount and timing of training.

Are exemptions and extensions to compliance requirements administered effectively?

3.28 The CATSI Act and the Corporations (Aboriginal and Torres Strait Islander) Regulations 2017 establish requirements for Indigenous corporations including lodging reports; holding an annual general meeting; maintaining financial records and member registers; and following a rule book. The Registrar may grant exemptions for requirements relating to: minimum number of corporation members; treatment of members/observers (for example, requirements to cancel membership if the member is uncontactable, misbehaving or not an Aboriginal and Torres Strait Islander person); holding meetings; directors/officers (including maximum number of directors, maximum director appointment terms and requirements to approve related party benefits); and record keeping and reporting.

3.29 A total of 658 exemption/extension requests were received in 2024–25 (excluding continuations of class determinations made in 2013 and 2018), covering 17 legislative exemption types.⁸¹ The total number of exemptions and extensions applied for, and the proportion approved, decreased over the five years to 2024–25, when the approval rate was 60 per cent (Figure 3.1). ORIC advised the ANAO in December 2025 that the decrease in the number of applications and approval rate was the result, in part, of ORIC signalling to the sector that a corporation can no longer expect to receive an extension of an extension or extensions for reasons that can be anticipated (for example, the wet season).

Figure 3.1: Exemptions and extensions approved and refused^a, 2020–21 to 2024–25

Note a: Class determinations made in 2013 and 2018 were continued in March 2025 (N=334) and three exemption requests that did not correspond to any legislative provision were removed from the analysis for 2024–25.

Source: ANAO based on ORIC data.

3.30 To grant an application, the Registrar must be satisfied that the CATSI Act requirements would be inappropriate in the circumstances or impose unreasonable burden (which could be created by the cost of compliance, practical difficulties or any other matters considered relevant by the Registrar).⁸² The ANAO examined a stratified random sample of 45 new exemption and extension applications made in 2024–25.⁸³ Of the 45 applications, 24 were granted and 21 were refused.

3.31 The CATSI Act states that applications must contain certain content, specify the related legislative provision, in certain circumstances be authorised by a resolution of the corporation’s directors, be in writing and be signed by a director. Of the 45 sampled applications, between 81 and 94 per cent met these various requirements. The Registrar considered incomplete applications in line with the Registrar’s discretion under the CATSI Act to make determinations even if applications are incomplete. The Registrar or decision-maker must take such steps to give in writing or otherwise the person’s right to have the decision reviewed.⁸⁴ Of the 21 letters advising of refused applications, 17 set out the right of review.

3.32 A Policy Statement (last updated February 2013) provides guidance on exemptions. In 2024 ORIC published a Position Statement and developed standard operating procedures for extensions to annual general meeting and reporting deadlines and for exemptions to director term requirements.⁸⁵ The Position Statements consider priorities established in the Registrar’s Regulatory Posture, such as potential impacts on member rights, self-determination, transparency, cultural considerations and administrative burden from these exemptions. The Position Statements state that corporations should not expect extensions applied for after the due date, consecutive or multiple extensions, extensions to director terms that are more than two years and director term exemptions without an end date. ORIC does not have Position Statements or standard operating procedures for five other types of exemptions.

3.33 The ANAO examined the full population of relevant approved applications for director term exemptions and annual general meeting extensions (where position statements existed), to assess whether ORIC’s handling of the applications adhered to position statements and standard operating procedures (Table 3.4).⁸⁶ Recognising that these allow for flexibility on a case-by-case basis, 29 per cent and 69 per cent of approved applications, respectively, specified an exemption end date or were not consecutive / additional.

Table 3.4: Management of approved exemptions and extensions

Source: ANAO analysis based on data provided by ORIC in August 2025.

3.34 In May 2025 ORIC commenced a review of director term exemptions and in June 2025, ORIC notified 120 corporations that had not responded to an earlier letter, of its intention to revoke the corporations’ director term exemptions. ORIC advised the ANAO in January and May 2026 that of 222 corporations identified, 100 corporations had their exemptions revoked by January 2026 and that it was continuing the review process for the remainder. In November 2025, ORIC updated its standard operating procedures for extensions to annual general meeting requirements, to require meeting minutes to demonstrate an annual general meeting has been held.

3.35 In an ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28), 67 per cent agreed that ORIC’s approach to granting extensions and exemptions assists corporations to comply with obligations under the CATSI Act and the corporation’s rule book, and 14 per cent disagreed. Several themes raised by respondents who disagreed related to lack of consistency and flexibility of decision-making

4.1 Resource Management Guide 128: Regulator Performance (RMG 128) states that compliance activities should be informed by data, evidence and intelligence and be proportionate to harm being managed.⁸⁷ Clear and consistent processes for understanding which regulated entities, activities and individuals pose the highest risk of non-compliance with regulatory requirements will position regulators to design and implement risk-based compliance programs that are aligned with this principle.⁸⁸

4.2 The CATSI Act establishes powers for the Registrar to address non-compliance with the CATSI Act. The main regulatory responses available to the Registrar under the CATSI Act are listed in Box 1, in roughly increasing order of degree of intervention.

Note a: A Policy Statement on no action letters was ‘retired’ in November 2025. ORIC advised staff in November 2025 that it intends to include guidance in various standard operating procedures.

Note b: ORIC maintains a public register on its website of disqualified officers as required under section 418-1 of the CATSI Act. Office of the Registrar of Indigenous Corporations, Register of Disqualified Officers, ORIC, available from https://mycorp.oric.gov.au/disqualified-officers-register/ [accessed 17 November 2025].

Note c: A person is automatically disqualified if they: signed a personal insolvency agreement and did not keep to it; were sentenced to three months or more in prison for an offence involving dishonesty in the last five years; were convicted of certain serious offences under the CATSI Act (or a foreign law) that are punishable by imprisonment for more than 12 months; or are disqualified under the Corporations Act 2001.

4.3 The CATSI Act states at section 566-5 that the Registrar may impose a prescribed penalty for a prescribed offence in the Corporations (Aboriginal and Torres Strait Islander) Regulations 2017 (CATSI Regulations). However, ORIC is not able to use penalty notices as the CATSI Regulations do not include any prescribed penalties nor prescribed offences.⁸⁹

Is the detection of non-compliance effective?

4.4 ORIC has visibility of corporations’ compliance with CATSI Act reporting obligations through the submission of reports to it but does not have direct visibility of some other requirements (for example, the holding of annual general meetings). It monitors compliance with these requirements through reports of concern and other reactive and proactive detection methods.⁹⁰

• Reports of concern and referrals (reactive) — Reports of concern about Indigenous corporation non-compliance can be made to ORIC by anyone. Other government agencies (such as program funders, law enforcement agencies and state government) may refer individual corporations to ORIC.
• Targeted examinations (reactive) — An examination is a review of the standard of governance and financial health of a corporation and is a power available to the Registrar under the CATSI Act. Targeted examinations focus on matters that come to the Registrar’s attention and the Registrar is satisfied that an examination of the books should be undertaken. The examination may cover compliance with the CATSI Act; management of financial affairs; the activities of directors, officers and staff; and the management of related party benefits. Examinations are generally undertaken by contractors engaged by ORIC and typically involve an assessment of a corporation’s documents and meetings with corporation personnel.
• Rolling program examinations (proactive) — Rolling program examinations are similar to targeted examinations but focus on corporations that meet certain characteristics rather than those that present specific compliance concerns.
• Data analytics and monitoring of reporting compliance (proactive) — Through general reports and other financial reports (see Table 1.2), ORIC collects data about Indigenous corporations that would allow it to undertake data analytics to assist with the detection of non-compliance and identification of risk factors. ORIC monitors non-compliance with reporting requirements. Financial, auditors’ and directors’ reports are reviewed for relevance and completeness.

4.5 Appendix 5 shows that ORIC has developed procedures, guidance and systems to support reactive detection activities. Proactive detection activities are less well supported by procedures, guidance and systems.

4.6 Appendix 5 shows that management of reports of concern and targeted and rolling program examinations are aligned with a proportionate, risk-based approach to detection. Data analytics and monitoring are less clearly risk based. Between 2008 and March 2025, ORIC rated each corporation’s non-compliance risk in its client relationship management system from ‘low’ to ‘extreme’ based on 11 risk factors (comprising size, audit opinion, materiality, liquidity, net trading result, nature of business, recent non-compliance, recent regulatory action, critical events including complaints, number of related party subsidiaries and reporting timeliness). According to a 2016 KPMG report, about half were rated high or extreme risk and the risk rating had a direct link to regulatory strategies and responses. When it implemented a new client relationship management system in March 2025, ORIC considered the utility of the risk rating functionality, including reviewing the correlation between corporation risk ratings and the outcomes of examinations. ORIC advised the ANAO in October 2025 that:

it was decided that broader factors need to be considered when assessing a corporation’s risk profile … These factors are difficult to capture as a calculated risk outcome and so the decision was taken not to build a risk engine in [the new client relationship management system].

While ORIC uses risk-based factors in reactive compliance activities (such as assessing reports of concern and decisions about allegations of serious non-compliance), it is unclear how the new approach of considering ‘broader risk factors’ is applied to assist with the planning of proactive activities. For example, there is no evidence of ‘broader risk factors’ besides size and industry being systematically considered in monitoring tools and being applied to consideration of the rolling examination program.

Has intervention occurred when required?

Response to non-compliance identified through reports of concern and referrals

4.7 There was a decline in the number of reports of concern in 2023–24 before increasing to the highest level in five years in 2024–25 (Figure 4.1), when 436 reports were received.

Figure 4.1: Reports of concern received by category^a, 2020–21 to 2024–25

Note a: Category is as determined by ORIC. Corporation directors and officers: about the conduct of directors or breaches of directors, officers or employees’ duties; Multiple categories: cover a number of issues and are not easily placed into a single category; Corporation meetings: members’ or directors’ meetings are not being held or meetings are not being held in accordance with the corporation’s rules or the CATSI Act; Membership issues: about the management of memberships, including incorrect membership details, removal of members; when directors are not processing applications or have refused membership applications; or members not being provided with information about their membership; Other categories: lower frequency categories including dispute handling, native title, rule book, record keeping, annual returns; Out of scope: about matters outside the Registrar’s jurisdiction; Other: cover a wide range of issues that are within the Registrar’s jurisdiction but not easily placed within the other categories.

Source: ANAO analysis of ORIC data. Definitions of categories are described in ORIC, Complaints involving Aboriginal and Torres Strait Islander corporations 1 January to 30 June 2024, ORIC, Canberra, 2025, available from https://www.oric.gov.au/ [accessed 21 November 2025] and advice provided in May 2026.

4.8 A service standard to acknowledge reports of concern within two working days and ‘resolve’⁹¹ a non-complex report of concern within 20 days is published on the ORIC website. Reports of concern were ‘resolved’ in the client relationship management system in an average of 12.5 working days in 2024–25 (Table 4.1). This was the fastest resolution time in five years.

Table 4.1: Timeliness of report of concern resolution, 2020–21 to 2024–25

Note a: Public holidays were not removed from the number of working days.

Source: ANAO analysis of ORIC client relationship management system data on 1,833 reports of concern.

4.9 The ANAO examined a random sample of 43 of 233 reports of concern over the period from the implementation of ORIC’s revised report of concern process on 25 October 2024 to 30 June 2025. ORIC appropriately captured the characteristics of each report of concern and followed appropriate processes in handling the reports (Table 4.2).

Table 4.2: ORIC’s management of reports of concern, 25 October 2024 to 30 June 2025

Key ◆ Largely or fully implemented in accordance with procedures ▲ Partly ■ Not at all

Note a: Where the person wishes to make an anonymous report but the report of concern has identifying details (such as a personal email address), ORIC’s procedures provide that the reporter is to be advised that their identity and complaint will be kept confidential and would only be shared by ORIC if compelled by law.

Source: ANAO analysis of a sample of 43 reports of concern made to ORIC.

4.10 ORIC considered each of the sampled 43 reports of concern and responded to the complainant in writing for all 43 reports that required a response. Where concerns related to directors, staff, members or disputes, ORIC advised on how matters raised might be addressed by the corporation or its members. Where concerns raised issues that were beyond the Registrar’s powers, ORIC referred the reporter to other agencies for further assistance. ORIC took regulatory action in response to three of the 43 reports of concern (two of which dealt with the same corporation), comprising a notice to produce documents and a compliance notice.

4.11 In an ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28), 46 per cent of survey respondents agreed that ORIC effectively responds to complaints and reports of concern, and 31 per cent disagreed. Several themes raised by respondents on this issue related to not responding to or taking action in response to complaints and reports of concern; and lack of timeliness of response.

4.12 ORIC advised the ANAO in December 2025 that:

The report of concern process was designed to empower members to use their rights under the CATSI Act to raise concerns with directors. This is also intended to build the capacity of corporations to resolve issues themselves. The purpose of which is to have a strong Aboriginal and Torres Strait Islander corporate sector which holds the trust and confidence of stakeholders.

Response to non-compliance identified through examinations

4.13 ORIC had 17 examinations underway on 1 July 2024, commenced 41 (19 targeted and 22 rolling program) during 2024–25, and finalised 42 by 30 June 2025. Of the 42 finalised examinations, 23 (55 per cent) resulted in a management letter; 17 (40 per cent) resulted in a compliance notice and two (five per cent) resulted in a show cause notice. ORIC advised the ANAO in December 2025 that in addition to its response to the finalised examinations, it intended to apply to the court to wind up two corporations as a result of two unfinalised examinations.

Response to non-compliance identified through data analytics and monitoring

4.14 ORIC used data analytics and monitoring to support activities including managing compliance with director ID requirements and to plan examination activities. Data analytics and monitoring were also used to identify corporations for potential Registrar-initiated deregistration or referral to the CDPP for minor regulatory prosecution.⁹²

• Deregistration — In December 2020, 156 corporations were deregistered through a ‘bulk’ process. ORIC advised the ANAO in December 2025 that data was examined in November 2022 to identify 374 corporations as candidates for deregistration because of inactivity or other criteria. In June 2024 ORIC identified 526 candidates. As shown in Table 4.5, 661 were deregistered by the Registrar between 2021–22 and 2024–25.
• Minor regulatory prosecutions — 615 non-compliant medium to large-sized corporations were identified in relation to the 2020–21 to 2023–24 reporting periods. As shown in Table 4.5, 48 medium to large-sized corporations were referred to the CDPP for minor regulatory prosecution between 2021–22 and 2024–25.

Response to director identification number non-compliance

4.15 Director identification (ID) numbers are unique identifiers that apply to individuals for life.⁹³ Director IDs support corporate accountability and transparency by protecting against fraudulent identities and illegal phoenix activity (abandoning corporations with debt to start new ones).

4.16 The Australian Taxation Office reported that as at 30 June 2024, 89 per cent of directors of corporations incorporated under the Corporations Act 2001 had a director ID.⁹⁴ Director ID requirements became mandatory for new directors of Indigenous corporations from 1 November 2022 and, for directors appointed prior to 1 November 2022, from 30 November 2023. In March 2025, the number of Indigenous corporations directors with a director ID was 7,808 (44 per cent of all directors) and the proportion of Indigenous corporations where all directors had a director ID was 28 per cent. The Registrar advised the Senate in February 2026 that director ID compliance was 45.6 per cent.⁹⁵

4.17 The power to issue infringement notices for failure to obtain or apply for a director ID number rests with the Commonwealth Registrar of the Australian Business Registry Services (ABRS) (the Commissioner of Taxation). Although ORIC is not able to issue infringement notices, from 1 November 2023, the ABRS was able to refer directors to ORIC for investigation and possible prosecution. Monitoring the uptake of director IDs provides transparency over the success of the director ID mechanism, supports compliance activity and is important in supporting benefits realisation. ORIC monitored director ID compliance through internal dashboards between July 2023 and March 2025. From April 2025 this monitoring was discontinued with the introduction of the new client relationship management system. ORIC advised the ANAO in December 2025 that director ID compliance is ‘checked as required’. Data on compliance with director ID requirements was considered by the Senior Management Group (SMG) in May 2025, June 2025, August 2025, September 2025 and March 2026. In November 2025, ORIC updated several standard operating procedures to require staff to check whether directors have director IDs.

4.18 The SMG was updated on a proposed director ID compliance strategy at five meetings between May 2025 and March 2026. ORIC advised the ANAO in December 2025 that it was developing a Position Statement and continuing discussions with ABRS regarding referral protocols. As at February 2026, ORIC’s director ID compliance strategy and draft Position Statement were being reviewed. The SMG was advised that the ABRS’ resources had been diverted to the ‘RegistryConnect program’, which would enable the Australian Securities and Investments Commission to verify director ID data in real time and issue infringement notices.⁹⁶

Have non-compliance responses been appropriately exercised?

Governance of regulatory response

4.19 Decisions about whether identified non-compliance requires a response and which responses to take are exercised by the Registrar and through delegations to the Deputy Registrar, two regional managers, the Manager of the Regulation section (Manager Regulation) and the Manager of the Investigations and Prosecutions section (Manager Investigations and Prosecutions).⁹⁷ The Regulatory Case Committee (RCC) endorses courses of action in relation to ‘complex’ cases.

4.20 Regulatory decision-making guidance and procedures support consistency, coordination, efficiency, transparency and business continuity.

• Regional managers review ORIC’s responses to reports of concern and under standard operating procedures for report of concern are required to consult with ‘relevant [parts] of ORIC and the Deputy Registrar as necessary’. Standard operating procedures for reports of concern include guidance and escalation arrangements, including for potential fraud, and thresholds and complexity calculations to guide further action. For reports of concern rated as moderate or major complexity, a referral to the RCC may be considered appropriate.
• The Manager Regulation responds to the outcomes of examinations, except where these are referred to the RCC. There is no documented standard operating procedure or similar that relates to the specific role of the Manager Regulation. For potential non-compliance detected through methods such as examinations, data analytics and monitoring, there is no equivalent escalation methodology to that set out in the procedures for reports of concern.
• The Manager Investigations and Prosecutions undertakes investigations and provides advice to the RCC. ORIC’s Investigations and Prosecutions Manual includes guidance to the Manager Investigations and Prosecutions and the Investigations and Prosecutions section.
• Terms of reference dated July 2023 state that the RCC’s role is to ‘largely oversee complex cases, ensuring a coordinated and consistent approach to ORIC’s regulatory enforcement, prosecutions, and interventions’. The terms of reference set out the RCC’s role in examinations, special administrations and investigations, which includes providing direction, considering referrals, monitoring, prioritisation, and making decisions about regulatory responses. The Investigations and Prosecutions Manual and RCC’s terms of reference provide that the RCC may refer complex matters to the Investigations and Prosecutions section for ‘assessment’ prior to an investigation commencing. The assessment considers the scope of the investigation, the admissible evidence, the likelihood that an investigation could result in a referral to CDPP or civil litigation and any significant investigative issues or risk. The RCC is then to consider the assessment in deciding whether to proceed to an investigation or take other action, using seven criteria.⁹⁸

4.21 Terms of reference (September 2022) for the Case Management, Regulation and Prosecution Committee — the precursor to the RCC — included an assessment and response model that categorised matters into four categories (no action required, routine, semi-complex, and complex or serious) and indicated appropriate responses for each category (close the matter, business as usual, discuss at weekly regional managers’ meeting, and refer to the committee, respectively). In October 2022, ORIC also developed a draft thresholds-based ‘case prioritisation model’ that was ‘designed to support consistency in decision making … [and] … the allocation of resources to regulatory interventions that are proportionate to the risk or consequences of the matter’. The model included a scoring system from 1–4 across six risk categories.⁹⁹ These were mapped to possible proportionate responses, including referral to the committee. In November 2022, the Case Management, Regulation and Prosecution Committee endorsed the use of the case prioritisation model but without the thresholds-based scoring on the basis that ‘linking a score to the suggested action could result in unintended outcomes’. The committee considered that a potential sensitivity to removing the scoring was that:

[ORIC] could be criticised for taking a flexible rather than formulaic approach to case prioritisation. However, this is a defensible approach given the diversity of the regulated population. Over time we can settle some guiding principles to support the consistent application of the model.

4.22 ORIC trialed the use of the case prioritisation model in 2023. The model was not included in the RCC’s terms of reference when it replaced the Case Management, Regulation and Prosecution Committee in August 2023. ORIC advised the ANAO in October 2025 that:

The Case assessment, categorisation and prioritisation process is unnecessary as we have the Regulatory Posture, Compliance framework and [Prosecution Policy of the Commonwealth]. Together these documents help guide the discussion at the RCC as to the most appropriate response to matters.

4.23 The Registrar’s Regulatory Posture and Compliance Framework, in addition to ORIC’s Investigations and Prosecutions Manual (updated in April 2016 and April 2025)¹⁰⁰, provide high-level guidance regarding possible ‘proportionate’ responses based primarily on the corporation’s attitude to compliance. Where there is considered to be ‘wilful’ non-compliance, the Registrar’s response is described as potentially being a Registrar-initiated meeting or rule book change, targeted examination, compliance or other notices, special administration and/or investigation. Where there is ‘deliberate’ non-compliance, the Registrar’s response is described as potentially being investigation, disqualification of persons, deregistration, winding up and and/or referral for prosecution.¹⁰¹ The Compliance Framework further states that in determining whether to prioritise a matter for investigation:

the Registrar pursues those investigations which have the potential to most influence community behaviours, and those for which a successful outcome will support well governed and self determining Aboriginal and Torres Strait Islander corporations.¹⁰²

4.24 In relation to some of the more frequently used and higher intervention activities outlined in Box 1, minor regulatory prosecutions were undertaken without a standard operating procedure or project plans. A standard operating procedure for ‘strict liability offences - non-reporting and annual general meetings’ was released in February 2026. In October 2024, a standard operating procedure for bulk deregistration projects was discussed with the SMG. A standard operating procedure for Registrar-initiated bulk deregistration was released in April 2026.

4.25 In March 2023 ORIC commissioned Projects Assured to assess the efficiency and effectiveness of its investigations and prosecutions function, with a focus on improving corporation compliance.¹⁰³ In relation to efficiency (defined as timely and streamlined) and relevance, the report concluded that there was limited evidence of a strategic and coordinated approach being taken, and that while a graduated model aligned to best practices and standards was being implemented, ‘there are lower-level aspects of the implementation of the overall strategy that present risks to the integrity of prosecutions, such as processes, case management approaches and IT systems in use’.

4.26 The Projects Assured report made 19 recommendations, of which ORIC agreed to implement 18.¹⁰⁴ The 10 ‘essential’ recommendations, which were all agreed to, included¹⁰⁵ streamlining internal processes; defining business rules for priority cases; and adopting a coordinated approach to dealing with non-compliance. The SMG was advised in May 2025 that the ‘coordinated process’ recommendation was completed despite processes and standard operating procedures still being in development for minor regulatory prosecutions and criminal offending and a process not yet developed for annual general meeting compliance. An October 2025 update to the SMG stated that all 18 agreed recommendations had been implemented. The ANAO assessed ORIC’s implementation of the agreed recommendations as at November 2025 and assessed that nine of the 10 essential recommendations were largely or fully implemented and one (adopting a coordinated approach for dealing with non-compliance) was partly implemented.

Regulatory response

4.28 In an ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28), 46 per cent agreed that ORIC’s actions in response to corporations’ non-compliance with the CATSI Act were reasonable and proportionate and 23 per cent disagreed. Some respondents stated there was good support to prevent non-compliance and others said that more could be done. Key themes among those who disagreed were a perceived lack of responsiveness, timeliness, flexibility and consistency in addressing non-compliance.

Lower intervention responses to non-compliance

4.29 Table 4.3 sets out ORIC’s regulatory responses between 2022–23 and 2024–25 for the lower intervention responses outlined in Box 1. In this period the number of Indigenous corporations was approximately 3,300.

4.30 ORIC advised the ANAO in September and December 2025 that the new client relationship management system implemented in March 2025 records when a no action letter or advisory notice has been made but not when it has been sent. ORIC also advised that, since 2023, it has issued 15 no action letters (primarily in recognition of natural disasters).

4.31 Table 4.3 shows that the number of other lower intervention responses have largely remained static or increased over the three years to 2024–25; and the issuing of compliance notices outside of examinations was used for the first time in 2024–25, consistent with a 2024–2027 ORIC ‘corporate plan’ priority to ‘[u]se compliance notices in expanded circumstances to provide more timely regulatory action’.¹⁰⁶

Table 4.3: Lower intervention regulatory responses, 2022–23 to 2024–25

Note a: Includes notices issued as part of other regulatory actions such as examinations.

Note b: ‘Other’ can include making a determination requiring additional or increased reporting.

Source: ANAO analysis of ORIC data, public reporting and ORIC advice. The ANAO did not validate the number of regulatory responses.

Higher intervention responses to non-compliance

4.32 The number of special administrations commenced and completed has remained broadly constant over the period 2022–23 to 2024–25 (Table 4.4). Of the eight corporations that exited special administration between 2022–23 and 2024–25, all were returned to member control. As at February 2026, all corporations remained registered and five of the eight had submitted the required annual reports for the 2024–25 reporting period.

Table 4.4: Special administrations commenced and completed 2022–23 to 2024–25

Source: ANAO analysis of ORIC data.

4.33 Serious non-compliance matters considered by the RCC in 2025, and their outcomes, are shown in Figure 4.2.

Figure 4.2: Serious non-compliance matters considered by the Regulatory Case Committee, 2025

Source: ANAO analysis of ORIC data.

4.34 ORIC reports the number of assessments and investigations to the SMG. After not concluding any investigations in 2021–22 in part due to the COVID-19 pandemic, ORIC concluded a similar level of investigations (nine on average) in each year over the period 2022–23 to 2024–25. Once the investigation was completed, an investigation summary was prepared for the RCC for consideration and endorsement before further action was taken.

4.35 The June 2023 Projects Assured report stated that no investigations had been referred for prosecution in the previous two years and that the benefit of prosecutions to achieve objectives was not being realised. Table 4.5 sets out ORIC’s enforcement actions from 2021–22 to 2024–25. ORIC recommenced referrals for minor regulatory prosecutions in 2023–24 after making no referrals between 2019–20 and 2022–23. ORIC advised the ANAO in December 2025 that minor regulatory prosecutions were suspended due to the COVID-19 pandemic. There were five successful minor regulatory prosecutions in 2023–24 and 21 in 2024–25. Between 2022–23 and 2024–25, two non-minor prosecutions (referred in May 2023 and September 2023) were successful.

Table 4.5: Enforcement actions, 2021–22 to 2024–25

Note a: Reporting to the SMG in June 2025 noted one civil litigation was referred to an external law firm to commence litigation.

Note b: In 2024–25, ORIC considered and engaged legal advice about obtaining civil orders and penalties against two former Indigenous corporation directors and had decided to commence a civil litigation against one director.

Note c: A person was added to the Register of Disqualified Officers in October 2025 following their 2024–25 conviction under paragraphs 561-1(1) (a) and (b) of the CATSI Act.

Note d: Includes bulk and individually deregistered corporations.

Note e: In 2024–25, ORIC considered but did not complete the winding up of 15 corporations and progressed action relating to these corporations in December 2025.

Note f: Non-minor prosecutions include any other criminal prosecutions pursued by ORIC that are not related to failing to lodge required reports. ORIC referred a further matter in August 2025.¹⁰⁷

Source: ANAO analysis of ORIC data and ORIC advice to the ANAO. The ANAO did not validate the number of enforcement actions undertaken.

4.36 In September 2023, the RCC undertook to determine by 26 October 2023 the ‘absolute deadline to lodge overdue reports before they are prosecuted’. This threshold was not determined. ORIC advised the ANAO in December 2025 that corporations that fail to submit within six months have breached the deadline. When ORIC recommenced minor regulatory prosecutions in September 2023, this was in relation to 2020–21 reports, 21 months after the reporting deadline of 31 December 2021. It has since taken earlier action to identify corporations for minor regulatory prosecution: for 2022–23 reports, corporations were first identified in February 2024 (two months after the deadline) and for 2023–24 reports, corporations were first identified in May 2025 (five months after the deadline).

4.37 In 2024 and 2025, the RCC has given consideration to expanding the scope of ORIC’s higher intervention responses across a range of non-compliances.

4.38 ORIC follows up on some types of regulatory responses, for example by requiring corporations that are issued with a compliance notice to provide assurances within a specified timeframe that identified matters have been addressed; and requiring corporations exiting special administration to provide additional reporting and information. ORIC advised the ANAO in December 2025 that if the corporation cannot demonstrate it has responded to a compliance notice, the compliance notice will remain open and in some circumstances, further regulatory action will be considered.

Are compliance outcomes improving?

Deterrence

4.39 ORIC undertakes a range of activities that seek to deter non-compliance.

• ORIC’s website and direct communications with corporations in newsletters and targeted campaigns incorporates messaging about penalties and potential regulatory actions if certain requirements are not met.
• ORIC publishes on its website a list of corporations that have not submitted annual reports over the previous two financial years, which is updated daily. Publication of this list was reinstated in late 2022 after being discontinued in mid-2018.
• ORIC publicises each successful prosecution on its website, noting the corporation/individual involved, the CATSI Act provisions breached and penalties imposed.
• A communications plan for the period January to June 2024, four communication schedules since August 2023 and five ad hoc communication plans for projects (see paragraph 3.3) include compliance messaging in relation to annual reporting, meetings and updating director details and deterrence messaging in relation to potential prosecution for non-compliance with annual reporting requirements and being included in the list of non-compliant corporations.

Achievement of compliance outcomes

4.40 In an ANAO survey of Indigenous corporations conducted in October and November 2025 (see paragraph 1.28), 48 per cent agreed that ORIC’s enforcement action is effective in deterring serious non-compliance or misconduct and 24 per cent disagreed. Themes raised by those who disagreed included a perceived lack of enforcement, timeliness, regulator visibility and decision-making consistency.

4.41 Timely annual reporting provides accurate, up-to-date information on an Indigenous corporation for its members, communities, creditors, investors and government agencies and builds the corporation’s reputation as a trustworthy corporation that is committed to accountability.¹⁰⁸ In addition to the benefits for members, communities, creditors, investors and government agencies, timely annual reporting supplies ORIC with data to support its analysis of risk factors and risk-based compliance activity planning. Annual reporting compliance for all corporations when measured as the lodgement of all required reports by 31 December has been in decline since 2015–16 (Figure 4.3). In 2023, ORIC attributed declines in reporting compliance to the COVID-19 pandemic, with an expectation that as business returned to normal corporations would meet their reporting obligations.¹⁰⁹

4.42 ORIC reports overall compliance rates (the black line in Figure 4.3) and has undertaken some analysis of annual reporting by size to inform and target its compliance activities. The SMG was presented with 2023–24 lodgement rates by size and state in April 2025. ORIC considers size as part of its minor regulatory prosecution and deregistration programs and in issuing annual reporting reminder letters. The ANAO estimated the ten-year trend in annual report lodgement rates by size. Figure 4.3 shows that the decline in lodgement has been greater for small and medium-sized corporations, however this occurs for all size types.

Figure 4.3: ANAO estimates^a,b of Indigenous corporations lodging all required reports at 31 December, by corporation size^c, 2015–16 to 2024–25 reporting periods

Key: Dotted lines are based on ORIC advice.

Note a: Results calculated by ORIC for all corporations (‘All corporations (As reported by ORIC)’) are those reported internally by ORIC.

Note b: Results presented for 2024–25 reports by size represent ORIC’s result at December 2025.

Note c: ORIC does not hold point in time data on reporting lodgement by size for the period periods 2015–16 to 2024–25, therefore the analysis is based on derivations. ANAO estimates use size classification as at September 2025. As a small proportion of registered corporations change size over time, the estimates may not accurately reflect the corporation’s size in each period. Analysis excludes a small number of corporations that report on the basis of calendar year. These numbers were calculated by the ANAO using ORIC data, however, do not exactly align to ORIC public reporting or internal monitoring for all corporations due to the application of different business rules and different data extraction times.

Source: ANAO analysis of ORIC data, ORIC internal reporting, ORIC advice to the ANAO and ORIC: What’s been the impact?, ORIC, February 2026, p. 4, available from https://www.oric.gov.au/sites/default/files/2026-03/Report%20-%20Whats%20been%20the%20impact%20-%202026-02_1.pdf [accessed 20 March 2026].

4.43 ORIC undertakes a range of communication activities with Indigenous corporations to remind them about reporting and annual general meeting requirements, to inform them about ORIC activities such as training and to provide information and guidance about the CATSI Act and governance. This has included up to six emails to corporations each year to remind them about reporting requirements, monthly newsletters to corporations, information and reminders about director ID and a corporation survey in 2024 and 2025.

4.44 The ANAO measured Indigenous corporations’ proactive engagement with ORIC between 2021–22 and 2023–24 (registered corporations’ lodgement of general reports, direct contact with ORIC to update corporation details, seeking support through making inquiries or applying for exemptions or extensions). The ANAO estimated that approximately 20 per cent of corporations had not directly contacted ORIC nor submitted a general report in each year. Of the one-fifth of corporations that did not lodge general reports or attempt to engage in any way with ORIC over 2022–23 to 2024–25, 94 per cent were small and six per cent were medium-sized. ORIC advised the ANAO in December 2025 that disengagement of this nature could be addressed by the deregistration of corporations, but stated that: ‘The Registrar has adopted the position of not deregistering corporations with assets as it would then require a significant redirection of scarce resources to dispose of these assets.’ ORIC advised the ANAO in May 2026 of a number of complexities associated with deregistering corporations with assets such as properties being actively leased for pastoral, housing, commercial, water or community purposes; a lack of interest in assets carrying liabilities or squatters; and risk to the Commonwealth when these assets vest in the Registrar. ORIC advised the ANAO in March 2026 that 45 corporations were removed from the list of potential corporations identified for deregistration as part of the 2024 bulk deregistration process (see paragraph 4.14) due to having assets, out of a pool of 526 potential corporations.

4.45 Failure to deregister inactive corporations, regardless of whether they hold assets, may create opportunity costs for Indigenous communities as assets are not available for repurposing or continued effective use or may be accruing debt. Failure to deregister may also create an uneven playing field for corporations that comply with CATSI Act requirements.

4.46 Resource Management Guide 128 Regulator Performance states that regulators should embed methodologies to understand the costs, impact and outcomes of regulation and collect evidence of this at a system-wide level, using insights to support and drive improved outcomes.¹¹⁰ ORIC does not have an evaluation strategy or program to understand whether the appropriate interventions are being used effectively or to understand the relative impact of its activities. In January 2026 ORIC developed a project plan with the objective of increasing small corporations’ reporting compliance to be delivered by 30 June 2026.

Appendix 1 Entity responses

National Indigenous Australians Agency

Registrar of Aboriginal and Torres Strait Islander Corporations

Department of Finance

Appendix 2 Improvements observed by the ANAO

1. The existence of independent external audit, and the accompanying potential for scrutiny improves performance. Improvements in administrative and management practices usually occur: in anticipation of ANAO audit activity; during an audit engagement; as interim findings are made; and/or after the audit has been completed and formal findings are communicated.

2. The Joint Committee of Public Accounts and Audit (JCPAA) has encouraged the ANAO to consider ways in which the ANAO could capture and describe some of these impacts. The ANAO’s corporate plan states that the ANAO’s annual performance statements will provide a narrative that will consider, amongst other matters, analysis of key improvements made by entities during a performance audit process based on information included in tabled performance audit reports.

3. Performance audits involve close engagement between the ANAO and the audited entity as well as other stakeholders involved in the program or activity being audited. Throughout the audit engagement, the ANAO outlines to the entity the preliminary audit findings, conclusions and potential audit recommendations. This ensures that final recommendations are appropriately targeted and encourages entities to take early remedial action on any identified matters during the course of an audit. Remedial actions entities may take during the audit include:

• strengthening governance arrangements;
• introducing or revising policies, strategies, guidelines or administrative processes; and
• initiating reviews or investigations.

4. In this context, the below actions were observed by the ANAO during the course of the audit. It is not clear whether these actions and/or the timing of these actions were planned in response to proposed or actual audit activity. The ANAO has not sought to obtain assurance over the source of these actions or whether they have been appropriately implemented.

Table A.1: Improvements observed by the ANAO

Appendix 3 Differences between incorporation legislation

1. Some differences between the Corporations Act 2001 (Corporations Act) and Corporations (Aboriginal and Torres Strait Islander Corporation) Act 2006 (CATSI Act) are shown in Table A.2.

Table A.2: Differences between the Corporations Act and CATSI Act

Note a: This is established in section 29-5 of the CATSI Act. If a corporation’s rule book allows for non-Indigenous directors, a majority of the directors (including any non-member directors) must be Aboriginal and/or Torres Strait Islander persons (sub section 246-5(1)).

Note b: Section 243-1 of the CATSI Act says provides that corporations with one member must have at least one director, corporations with 2 members must have at least 2 directors and corporations with more than 2 members must have at least 3 directors.

Note c: Sub section 246-1(3) of the CATSI Act provides that unless a corporation’s rule book provides otherwise, all directors of corporations must be individuals who are Aboriginal and/or Torres Strait Islander persons.

Source: ANAO adapted from Australian Securities and Investments Commission, ‘ASIC fact sheet: The CATSI Act and the Corporations Act some differences’, January 2018, available from https://download.asic.gov.au /media/4907483/fact-sheet-catsi-act-vs-corp-act.pdf [accessed 22 October 2025].

Appendix 4 Business process reviews and assessments

Table A.3: Business process internal and commissioned reviews and assessments, 2022–23 to 2024–25

Note a: Austender contract: CN3961490, 1 May 2023, $535,755.

Note b: Austender contract: CN4019796, 30 November 2023, $13,069.

Note c: Austender contract: CN4112433, 3 December 2024, $74,800.

Note d: Austender contract: CN4054654, 14 May 2024, $40,425.

Note e: Austender contract: CN3958583, 18 April 2023, $14,300.
Austender contract: CN4024159-A1, 22 March 2024, $62,920.
Austender contract: CN4047201, 17 April 2024, $15,730.
Austender contract: CN4108284, 14 November 2024, $57,812.
Austender contract: CN4110865, 27 November 2024, $31,460.
Austender contract: CN4129559, 20 February 2025, $28,314.

Source: ANAO analysis of ORIC documentation. The ANAO does not provide assurance over whether recommendations from the reviews listed in Table A.3 were implemented.

Appendix 5 Detection activities

Key ◆ Largely or fully aligned ▲ Partly aligned ■ Not at all aligned

Note a: Attorney-General’s Department, Australian Government Investigations Standards, Canberra, 2011, p. 5, available from https://www.ag.gov.au/sites/default/files /2022-12/Australian-Government-Investigations-Standard-2011.pdf [accessed 10 November 2025]. The Australian Government Investigations Standards 2022 do not cover identification of breaches; receiving / recording breaches; evaluation of referrals and conduct; accepting matters for investigation; or use of intelligence.

Note b: ORIC advised the ANAO in January 2026 that the number of corporations that indicated they would provide their financial information at a later time, and did, was 212 for 2022–23 and 162 for 2023–24. Those corporations that provided their financial information at a later date may include corporations that lodged general report/s after July 2025.

Source: ANAO analysis.