A sales and use tax audit is a state revenue department’s review of whether your business collected, reported, and paid the right tax on sales and purchases, usually over the past three or four years. The process moves through a predictable sequence: a notification letter, a document request, fieldwork with some form of sampling, an exit conference where preliminary findings land on the table, and a formal assessment you can protest within a strict deadline. How much you end up owing depends less on what happened during the audit period than on how you handle documentation, sampling methodology, and the exit conference.
Why Your Business Was Selected
States don’t pick audit targets at random. They run data analysis to find companies most likely to have underpaid, and a few patterns light up their systems reliably. The strongest signal is a mismatch between the gross receipts on your federal income tax return and the taxable sales on your state sales tax returns. If you reported $3 million in revenue to the IRS but $2.4 million in taxable sales to the state, an auditor will want to know where the gap went.
Other triggers include sharp swings in reported taxable sales between periods, operating in an industry with complex exemptions (construction, manufacturing, and restaurants are perennial favorites), or being a vendor or customer of another business already under audit. That last one catches companies off guard. When a supplier gets audited and the auditor finds transactions with no tax collected, the customers on those invoices often get flagged next.
Some selection is genuinely random, but random picks are a small share of the total. Most states blend algorithmic scoring with industry risk factors to decide where to deploy staff.
The Notice and the Statute of Limitations
Everything starts with a formal notification letter identifying the assigned auditor, the tax periods under review, and an initial document request. Treat it as a legal deadline.
Before you respond, check the statute of limitations for the periods listed. Most states limit their look-back to three or four years from the date a return was filed. That window is your first defense: if the auditor is reaching outside it, push back. But the limitation only protects you if you actually filed. In many states, when no return was filed for a period, the clock never started, and the state can reach back indefinitely.
Waiver Requests
If the auditor can’t finish before the statute expires on an older period, expect a request that you sign a waiver extending the deadline. You are not required to sign. Agreeing gives the auditor more time to examine your records and assess additional tax. Refusing, though, can prompt the state to issue an immediate estimated assessment for the expiring period to preserve its right to collect, and estimated assessments tend to run high because the auditor hasn’t reviewed your actual records. The practical move is usually to negotiate a waiver with a specific end date rather than signing open-ended or refusing outright.
Getting Your Records Ready
Once the letter is in hand, pull together every record on the document request. Expect the auditor to ask for filed returns, general ledgers, sales journals, and purchase journals for the audit period. Fixed asset listings, depreciation schedules, and purchase invoices are standard too, because auditors use them to look for use tax that was never accrued on capital equipment and other big-ticket purchases.
Exemption certificates get their own file. The burden of proving a sale was exempt falls entirely on you as the seller. If the auditor pulls a transaction where you didn’t collect tax and you can’t produce a valid resale or exemption certificate, the default outcome is an assessment for the full tax plus interest and penalties. Certificates need to be complete, properly executed, and on file before the audit. Scrambling to collect backdated certificates during the audit is a weak position.
Run Your Own Pre-Audit
Before the auditor arrives, review the audit-period records yourself. Look for missing certificates you can still obtain from customers, purchase invoices where use tax should have been accrued, and returns with transposition errors. Identifying and disclosing issues on your own terms beats having the auditor discover them. It also signals that your business takes compliance seriously, which can influence how hard the auditor pushes on gray areas.
Control the Flow of Information
Designate a single point of contact for all communication with the auditor. That person controls what information moves and when, which stops well-meaning employees from handing over unrequested documents or answering questions that expand the scope. Set aside a private workspace for the auditor away from your main operations. Keep a detailed log of every document you provide, cross-referenced against the original request list.
Provide only the documents specifically requested. This isn’t about being uncooperative; it’s about keeping the audit focused on the scope defined in the notification letter. On the other side, ignoring the audit or refusing to cooperate doesn’t make it go away. When a business stonewalls, the state issues an estimated assessment based on industry averages, markup analysis, bank deposits, or error rates from similar businesses, and those estimates almost always exceed what actual records would show.
Fieldwork and Sampling
Fieldwork opens with a conference where your designated contact meets the auditor to confirm timeline, scope, and methodology. Pay close attention to the methodology discussion. It determines how any assessment will be calculated.
How Samples Work
Most auditors don’t review every transaction. They examine a sample and project any errors found across the full population. Block sampling selects one or more specific time periods (say, two months out of a three-year window) and extrapolates results across the rest. Statistical sampling randomly selects individual transactions, stratifies them by dollar amount, and uses the error rate to calculate a projected assessment.
Stratification matters more than most businesses realize. Done correctly, it separates high-dollar transactions into their own group and audits them individually, which prevents a single large purchase from inflating the error rate projected onto thousands of smaller transactions.1Multistate Tax Commission. Statistical Sampling for Sales and Use Tax Audits If the sample isn’t stratified or includes an unrepresentative period, say a month when your point-of-sale system was down, the projected assessment can be wildly overstated.
Negotiate Before the Sample Is Pulled
You have the right to negotiate sampling parameters before the auditor begins detailed work. Push for a sample period that reflects normal business operations. If you know a particular quarter had unusual activity (a one-time bulk sale, a system migration that disrupted recordkeeping), raise it early. You can also request a detailed audit of specific transaction categories instead of sampling, though auditors generally resist this when transaction volume is large. Challenge the methodology before the sample is pulled, not after you see the results.
What Auditors Look For
Use Tax on Purchases
Use tax is the mirror of sales tax. When you buy something taxable and the seller doesn’t collect (typically because the seller is out of state or the purchase was online), you owe use tax directly to your state at the same rate. Auditors comb expense accounts, fixed asset schedules, and accounts payable records for purchases where no tax was paid. Common targets are office supplies, software licenses, computer equipment, maintenance contracts, and items bought through online marketplaces. If your accounting system doesn’t flag untaxed purchases for use tax accrual, this is where the biggest dollar assessments tend to land.
Exemption Certificates
Most audits generate their findings here. The auditor pulls a sample of transactions where you didn’t collect tax, then asks for the corresponding certificates. Missing certificates, incomplete ones (no signature, wrong entity name, missing identification numbers), or certificates that don’t match the type of goods sold all produce assessments for the uncollected tax. Even a certificate that was valid when accepted can cause problems if it has since expired. Keep a system for tracking expiration dates, and make obtaining a valid certificate a condition of extending exempt pricing.
Nexus in Other States
If you sell into other states, the auditor may review whether you have a collection obligation you’ve been ignoring. Physical presence triggers include employees working remotely in another state, inventory stored in a third-party warehouse, and installation or service work performed on-site at customer locations. Beyond physical presence, most states now impose economic nexus thresholds based on sales volume. The most common is $100,000 in annual sales into the state, though some states also trigger registration on transaction count. Several states have dropped their transaction-count thresholds recently, so a business that checked the rules a few years ago may find the picture has changed.
Taxability of Services
Whether a service is taxable varies enormously by state. Software maintenance, installation labor, data processing, consulting bundled with deliverables: each might be taxable in one state and exempt in the next. Auditors focus on bundled transactions where a taxable product and a potentially nontaxable service appear on a single invoice. If the invoice doesn’t state each component’s price separately, many states treat the entire charge as taxable. Breaking out services on your invoices directly reduces audit exposure.
Gross Receipts Reconciliation
Auditors compare total revenue on your income tax returns to taxable sales on your sales tax returns. A gap isn’t automatically a problem; legitimate differences include exempt sales, returns, and nontaxable service revenue. But if you can’t explain the gap with documentation, the auditor will treat it as unreported taxable sales and assess tax on the full difference. This reconciliation is often the first thing the auditor runs, and a large unexplained discrepancy sets the tone for everything after.
Penalties, Interest, and Abatement
An assessment has three components: the tax itself, interest on the unpaid amount, and penalties. Interest accrues from the original due date of the tax, not from the date the auditor finds the error, so a four-year audit period can generate substantial interest even on modest underpayments. Rates vary by state but typically run in the range of the federal short-term rate plus several percentage points, recalculated quarterly.
Most states impose tiered penalties. Late payment or underpayment penalties commonly range from 5% to 25% of the tax due, depending on how late the payment is and which state is involved. A higher rate applies when the state determines the underpayment resulted from negligence or disregard of the rules rather than a simple mistake. The steepest tier, which can reach 50% to 75% of the deficiency in some states, applies when the state has evidence of deliberate evasion: things like keeping a second set of books, systematically suppressing taxable sales, or filing returns you knew were false.
Getting Penalties Reduced
Penalties are often negotiable in a way that the underlying tax and interest are not. Most states allow abatement if you can demonstrate reasonable cause. The standard is whether you exercised ordinary business care and still couldn’t meet your obligations. Grounds that commonly qualify include serious illness or a death in the family, a natural disaster that destroyed records, reliance on incorrect advice from a tax professional, or a one-time error in an otherwise clean compliance history. If this is your first audit and you’ve been filing consistently, that history alone may be enough. Put the request in writing and be specific about the circumstances.
The Exit Conference
When fieldwork wraps up, the auditor presents preliminary findings in a closing meeting. You’ll see the proposed adjustments, the sampling methodology and error rates used, and the work papers showing which transactions or error categories drove the projection. This is your first real chance to challenge the results.
Come prepared. If the findings include transactions where you have a valid certificate that wasn’t in the original file, produce it now. If the sample included an atypical period that skewed the projection, show the data. If a specific transaction was misclassified, walk the auditor through the documentation. Auditors have discretion to adjust findings at this stage, and they’re more willing to concede when you present clear evidence rather than vague objections. Most disputes are harder to resolve once the assessment is formally issued.
After the exit conference, the state issues a formal notice, typically called a Notice of Proposed Assessment or Notice of Deficiency, stating the total tax, interest, and penalties. The date on that notice starts the clock for your appeal rights.
Appealing an Assessment
If you disagree after the exit conference, your next step is a formal administrative protest, sometimes called a Petition for Redetermination or Reassessment. The filing deadline is strict and varies by state, typically 30 to 90 days from the date of the notice. Missing this deadline is one of the most expensive mistakes a business can make: it generally renders the assessment final, eliminates appeal rights, and starts collection.
Your protest should identify which findings you’re challenging and why, whether that’s a factual error (the auditor misidentified a transaction), a legal disagreement (the service isn’t taxable under the state’s statute), or a methodological objection (the sample produced an unreliable projection). The protest typically goes first to an informal conference with an appeals officer independent of the audit team, and many disputes get resolved there.
If the informal conference doesn’t produce a resolution, the next step is a formal hearing before the state’s tax tribunal or an administrative law judge, where you present evidence and legal arguments in a quasi-judicial proceeding. Beyond that, the final option is judicial review in the state court system, but you must exhaust administrative remedies first. Each step raises the cost and complexity, which is why investing in a strong exit conference and a well-drafted protest usually delivers the best return.
Alternatives: Managed Audits and Voluntary Disclosure
Some states offer managed audit programs as an alternative to a traditional field audit. In a managed audit, you or an outside firm you hire examine your own books under the state’s guidance instead of having a state auditor on-site going through records. The state defines scope and methodology; you do the review and report the findings. States offering managed audits typically waive or reduce penalties on any deficiency uncovered, and the process causes far less disruption. Not every business qualifies; the program is usually reserved for companies with organized records and a good-faith compliance history.
If your business discovers it should have been collecting tax in a state where it never registered, a voluntary disclosure agreement is almost always better than waiting to get caught. The Multistate Tax Commission runs a program that lets businesses negotiate settlements with multiple states through a single coordinated process, at no cost to the taxpayer.2Multistate Tax Commission. Multistate Voluntary Disclosure Program The core trade: you agree to register, file returns, and pay back taxes for a limited look-back (often three to four years), and the state waives penalties and doesn’t pursue liability for years before the look-back window. Without an agreement, the state can potentially assess every noncompliant year, which may stretch back a decade or more. Interest on back taxes is still owed under most agreements, but eliminating penalties and capping the look-back can cut total exposure dramatically.
When to Bring in a Specialist
Not every sales tax audit requires outside help. If the audit covers a single state, your records are clean, and the dollar amounts are modest, your in-house accounting team or regular CPA may handle it fine. When the audit involves multiple states, a complex industry with unusual exemption issues, sampling methodologies you don’t fully understand, or a potential assessment large enough to materially affect your business, hiring a state and local tax attorney or a CPA who specializes in indirect tax is money well spent.
A specialist brings two things a general accountant usually doesn’t: familiarity with how a specific state’s auditors actually operate, and experience negotiating reductions at the exit conference and protest stages. They know which arguments work with a particular appeals division and which ones waste everyone’s time. For businesses facing a six-figure assessment, professional representation during the exit conference alone frequently pays for itself in reduced liability.