The Code of Conduct tells you what your client file must contain. Section 56(2) lists eight categories of document, and a practice that holds all eight can fairly say it complies.
Then section 55 uses a word that is not about documents at all.
An agent must make a contemporaneous written record of oral communications with a client, including instructions the client gives and advice the agent gives. Contemporaneous is not a description of the record's content. It is a claim about when the record came into existence — and whether you can support that claim depends entirely on the system you keep it in.
Documents are what you hold; events are what you can prove
A file note saying "27 May — advised client that the 28-day deadline could not be extended" is a document. It becomes evidence when you can also show it was written on 27 May, by a particular person, and has not been altered since.
Almost every dispute a migration practice faces turns on that second layer. Did the advice come before or after the client made their decision? Was the estimate given before the work started? Did the conflict disclosure precede the assistance, as section 34 requires? The document alone answers none of those; the ordering does, and ordering is an audit trail question.
This is the gap between a filing system and a record. Our guide to file note requirements covers what to write. This one is about what has to be true of the writing.
What breaks contemporaneity
Three common arrangements quietly destroy the claim:
- An editable date field. If a note's date is something a user types, the date proves nothing. A system that captures when the record was actually created — separately from the date of the conversation it describes — preserves both facts. One is evidence; the other is a label.
- Silent editing. A note that can be revised without leaving a trace means every note in the system is only as reliable as the last person to open it. Notes should be appendable and corrections visible as corrections.
- Notes written in batches. Six calls written up on Friday afternoon are not contemporaneous records of six conversations, however accurate. This is a workflow problem before it is a software problem, but software that makes capture during the call easy is most of the fix.
None of this requires exotic technology. It requires that the system record facts rather than accept assertions.
The events worth making immutable
Map the Code's obligations to the moments that prove them, and a list of events falls out.
Advice and instructions. Section 55 for oral communications. Section 39 requires you to advise the client in writing when anything is lodged, give them a copy, and promptly advise material developments — three separate events, each with a time.
The agreement and its variations. Section 56(2)(b) requires copies of all service agreements and any variations. Section 44 requires the client's written agreement to a variation before it takes effect, so the order of the notice, the agreement and the work is the compliance question.
Conflict disclosures. Section 34 requires the written notice and the client's written statement before assistance is given. The sequence is the substance.
Money. Section 49 requires an itemised invoice before a charge and a receipt after payment. Section 50 restricts what may be paid into and out of the account holding client money. Section 52 requires refunds within 14 days of becoming payable. Each is a dated event with a required predecessor.
Documents in and out. Section 56(2)(g) requires copies of personal documents the client gave you, and section 56(2)(h) requires evidence of the safe return of originals. That second one is explicitly an event record, not a document.
Third-party communications. Section 56(2)(e) requires records of material oral communications with anyone other than the client, to the extent they relate to the client. The call to the case officer belongs on the trail.
Retention. Section 56(5) sets seven years from the last action on the file, which means the system needs to know when the last action was — itself an audit trail question rather than a stored date.
Attribution: who, not only what
An audit trail that records what happened but not who did it cannot answer the questions that matter most in a practice with staff.
Section 24 makes an agent responsible for the quality, accuracy and timeliness of work performed by another person assisting them. Answering for that work requires knowing which work it was.
Shared logins break two duties at once
Section 25(3) requires reasonable steps to ensure an agent's MARN is not used in a way suggesting assistance given by another person was given by the agent — and section 25(4) requires written notice to the Authority within 14 days of becoming aware of misuse.
A shared account makes both unanswerable. If four people work under one login, the record cannot distinguish them, so you cannot show whose work an application was, and you would have no way of detecting the misuse you are obliged to report within 14 days of noticing it.
Section 12 adds a subtler need. A responsible migration agent includes any agent who gives immigration assistance under an agreement, and OMARA's guidance confirms that even an agent who gives input toward a matter falls within it. If your system cannot show which agents touched a matter, it cannot tell you who your responsible agents are.
OMARA's guidance on practice management duties reinforces the point from the other end, listing among supervisory arrangements the maintenance of records of internal discussions with staff about client applications, and ensuring an agent's MARN is not improperly used by employees to lodge through ImmiAccount.
Producing it
Three provisions turn your trail from an internal comfort into something you hand over.
Section 32 requires you to respond to an Authority request promptly, deal with each matter raised, answer any questions, and include all requested information or documents. Section 56(9) requires you to give the Authority access to a client file held by you or anyone in your business. And section 50(2) requires you to demonstrate to the Authority, on request, that the client-money rules are being complied with.
Demonstrate is a stronger verb than assert. It presumes a record capable of showing conduct over time, which is exactly what an audit trail is.
What a defensible trail looks like
- Every record carries a system-captured creation time, distinct from any user-entered date
- Records are append-only; corrections appear as corrections rather than replacing the original
- Every action attributes to an individual account, with no shared logins
- Document versions are retained, so what was sent can be distinguished from what exists now
- Money movements reference the invoice, receipt or refund that authorised them
- Access is itself logged — who opened which client file, and when
- The trail is exportable per matter, because that is the unit the Authority asks for
The reconstruction test
Pick a matter that closed a year ago and try to establish, from the system alone:
- On what date was the client advised of the risk that later materialised?
- Was the conflict disclosure given before assistance began?
- Was the variation agreed in writing before the extra work?
- Which staff member prepared the application, and which agent reviewed it?
- Was an itemised invoice issued before each charge?
- When was the last action, and what is the retention date it produces?
If any answer requires asking a colleague what they remember, that is the part of the trail that does not exist.
Where a system helps
Audit trails are not a feature you turn on. They are a by-product of a system that records what people do instead of asking them to describe it afterwards.
That is the practical difference between a shared drive with a folder per client and a case management system: one stores the documents, the other knows the sequence. Our comparison of case management software for migration agents covers what to look for.
LodgeHQ timestamps and attributes actions as they happen, keeps document versions, and ties money movements to the invoice that authorised them. Start a free trial and see what your last twelve months would look like as a sequence rather than a folder.
Verify before you rely on it
Record-keeping obligations were restructured in the current Code, and the clause numbers in older compliance manuals no longer correspond to anything. Read the current text: the prescribed Code and the Regulations on the Federal Register.
This is general information for migration practices, not legal advice. Where a specific matter is in dispute or under review, get advice before altering, annotating or reorganising the file.