Disqualified SMSF Auditor Sentenced for Falsifying 47 Audit Reports While Banned

Key Takeaways

• ASIC secured a criminal conviction against Kristian Convery, a permanently disqualified SMSF auditor who continued to perform audits and falsified 47 audit reports using another auditor's credentials without consent.
• The case demonstrates ASIC's willingness to pursue criminal prosecution—not just civil penalties—against individuals who breach disqualification orders, underscoring the importance of robust auditor verification controls for firms engaging SMSF audit services.

Deep Dive

This matter illustrates the serious legal and reputational consequences facing professionals who act in breach of ASIC disqualification orders, and it highlights a broader compliance risk for firms and tax agents who engage third-party auditors without adequate verification. Mr Convery continued operating as an SMSF auditor for seven months after his permanent disqualification took effect, providing services to four tax agents who may not have independently verified his registration status with ASIC's registers.

For compliance teams—particularly those at tax agent practices, accounting firms, and superannuation fund administrators—this case reinforces the necessity of verifying auditor credentials against ASIC's publicly available disqualified persons register prior to engagement and on an ongoing basis throughout any audit relationship. The falsification of 47 audit reports in another registered auditor's name, without that auditor's knowledge or consent, also raises identity misuse and document integrity concerns that firms should factor into their third-party due diligence processes.

Key timelines in this matter include: disqualification effective 15 May 2024; misconduct occurring between June 2024 and January 2025; charges laid in November 2025; and sentencing on 2 September 2026. The relatively short gap between disqualification and resumption of unauthorized activity suggests gaps in market-wide monitoring mechanisms that compliance functions should not rely upon as a sole safeguard.

Recommended actions include implementing periodic cross-checks of auditor registration status against ASIC's register, establishing internal controls to confirm the named auditor on any SMSF audit report personally performed the work (e.g., through direct confirmation or digital signature verification), and reviewing vendor/service provider onboarding policies for professional services engaged in regulated activities. Firms that engaged Mr Convery's services—knowingly or not—may face downstream regulatory scrutiny regarding the validity of SMSF audits lodged with the ATO, potentially triggering remediation obligations.

From a risk perspective, this case is a moderate-severity enforcement action with high instructive value: it signals ASIC's continued use of criminal referral (via the CDPP) for serious breaches of disqualification orders, rather than relying solely on administrative sanctions. Firms in the superannuation and audit services value chain should treat this as a prompt to strengthen third-party verification controls and document authenticity checks.

Source: Australian Securities and Investments Commission