How to build a marketing compliance audit trail for Australian health brands (2026)

"We didn't know" is not a defence to advertising non-compliance under Australian health regulation. The Therapeutic Goods Act 1989 and the Health Practitioner Regulation National Law impose obligations on brands and practitioners regardless of awareness. The TGA does not require that a business intended to breach the Advertising Code — only that the advertisement breached it. AHPRA does not require that a practitioner knew their Instagram post contained a prohibited testimonial — only that it did.

What regulators do consider, when assessing how to respond to a breach, is whether the business or practitioner took reasonable steps to ensure compliance before publication. Reasonable steps is not a defined statutory standard — it is assessed on the facts of each case. But the most reliable evidence of reasonable steps is a documented compliance review conducted before the content went live. An audit trail is that evidence.

The reasonable steps concept appears in several contexts across Australian consumer and health regulation. The ACCC applies a similar standard to misleading conduct defences under the Australian Consumer Law. AHPRA's compliance and enforcement policy explicitly considers whether a practitioner has taken proactive steps to understand and comply with the advertising guidelines.

In practice, reasonable steps means:

• The business or practitioner was aware that advertising rules applied to their content
• They checked the content against those rules before publishing
• They retained a record of that check
• They acted on the findings — amending or not publishing content that was identified as non-compliant

What does not constitute reasonable steps: assuming content is compliant without checking; relying on the fact that similar content appears elsewhere in the market; or checking once and assuming ongoing compliance without reviewing new content.

Reasonable steps is assessed per piece of content, not per business. A brand that has a compliance review process in place but did not apply it to a specific post cannot rely on the process to defend that post.

A compliant marketing compliance audit trail is not a complex document. It is a structured record that answers five questions for each piece of content reviewed:

1. What was reviewed?
The exact content — copy, images, claims, channel — in the version submitted for review. Version control matters: if the content is subsequently amended, the review applies to the version reviewed, not the amended version. Amended content requires a new review.

2. When was it reviewed?
A timestamp showing the date and time of review, before publication. Post-publication reviews do not establish pre-publication compliance. The review must precede the content going live.

3. What frameworks were checked?
The specific regulatory frameworks assessed — TGA Advertising Code, AHPRA Guidelines, FSANZ Standards, ACCC ACL — and the specific clauses considered. Naming the framework is not sufficient; identifying the clause demonstrates that the review was substantive rather than superficial.

4. What was the outcome?
The risk assessment for the content: compliant, requires amendment, or not suitable for publication. Where amendments were required, the record should show what was identified, what change was made, and confirmation that the amended version was reviewed.

5. Who conducted the review?
The identity of the reviewer — whether an internal team member, a regulatory consultant, or a compliance system. Where a system is used, the record should identify the system and the version of the regulatory knowledge base it applied.

When the TGA or AHPRA initiates an investigation into advertising content, the information they typically request first includes: the content in question (URL, screenshot, or document); the date the content was first published; any compliance review records for that content; and the name and contact details of the responsible person.

The absence of a compliance review record is not automatically evidence of a breach — but it is the absence of the most useful piece of evidence in a practitioner or brand's favour. Where no review record exists, the regulator's assessment of the breach is made without any mitigating context from the business.

The presence of a compliance review record — showing the content was checked, the specific risks were identified, and the content was assessed as compliant (or was amended to be compliant) — provides the regulator with direct evidence of due diligence. It does not guarantee a favourable outcome if the content is genuinely non-compliant, but it is the most credible form of mitigation available.

For individual practitioners publishing occasional social media content, a simple spreadsheet — content, date, frameworks checked, outcome, reviewer — may be sufficient. For health brands running multi-product marketing programmes across multiple channels, a spreadsheet is not a sustainable compliance infrastructure.

At scale, a compliance audit trail needs to be: systematically applied (every piece of content, every time, not selectively); version-controlled (tracking amendments and re-reviews); retained for a sufficient period (TGA complaint timeframes and limitation periods suggest a minimum of five years); and accessible (retrievable quickly if a regulator asks for it).

The administrative cost of building and maintaining this system manually — across a team of marketers, across multiple products and channels — is the primary reason most health brands do not have a functioning audit trail. The cost of not having one materialises only when a complaint arrives, at which point the opportunity to establish the record has passed.

The Therapeutic Goods Advertising Code is currently under formal review by the TGA (2025–26). This guide reflects the current Code. This content does not constitute legal advice. For binding regulatory interpretations, consult a qualified regulatory professional.

• Publishing without checking the complete advertisement’s overall impression.
• Treating one regulator’s checklist as coverage for every applicable framework.
• Failing to retain evidence showing what was reviewed and approved before publication.

CompliGUARD reviews the complete advertisement against TGA · AHPRA · FSANZ · ACCC requirements, identifies clause-level risks, proposes compliant wording, and retains the result in an audit trail before publication.