States run sales tax audit programs to raise revenue, and those programs are expected to pay for themselves. Auditors are assigned to find assessments, not to confirm you did everything right. Since the Supreme Court decided South Dakota v. Wayfair, Inc. 5-4 on June 21, 2018, states have aggressively pursued remote sellers who crossed economic thresholds but never registered.
The verdict: most audits are triggered, not random. The usual triggers are unregistered nexus after a threshold is crossed and returns that do not match federal filings or third-party data. The risks are back tax, interest, stacked penalties, personal liability for owners, and, in fraud cases, criminal exposure. The defense is continuous preparation: monitor nexus, keep exemption certificates current, and never sign auditor documents without representation.
What Is a Sales Tax Audit?
A sales tax audit is a formal examination by a state Department of Revenue (DOR) that verifies a business correctly determined taxability, collected the right tax, remitted it on time, documented every exempt sale, and paid use tax on untaxed purchases. It confirms that what you filed matches what you actually owed.
Auditors find problems by reconciling sources against each other. They compare your filed sales tax returns against your federal income tax returns, general ledger, bank deposits, and invoice or point-of-sale (POS) data. Mismatches between those records are the primary source of assessments.
Why Are Sales Tax Audits Conducted?
States audit to ensure compliance, recover unpaid tax, and prevent fraud, but the real driver is revenue enforcement. Audit divisions are self-funding, and auditors are expected to generate assessments that exceed their own cost. States also use third-party data matching and post-Wayfair targeting to decide whom to audit. Genuinely random audits are a minority.
Data matching flags under-reporters automatically. States cross-reference 1099-K forms (the payment and marketplace reporting form) and marketplace facilitator reports against filed returns. Post-Wayfair, the Court noted South Dakota alone estimated $48 million to $58 million in annual lost revenue under the old physical-presence rule, per the Wayfair opinion. Unregistered remote sellers are the top enforcement target.
What Are the Most Common Sales Tax Audit Triggers?
The most common triggers are filing errors, reporting inconsistencies, high-risk industry membership, nexus changes, and large or unusual exempt-sale claims. Errors and mismatches invite a closer look. Crossing a nexus threshold without registering is now the single sharpest trigger for remote sellers, and industry selection accounts for much of the rest.
Small businesses raise specific red flags. Reported sales that diverge from federal returns or 1099-K totals draw scrutiny. So do high ratios of exempt sales without certificates on file, cash-heavy operations, zero-tax returns in taxable categories, and registering in a state late, which self-flags prior exposure. Collecting tax from customers and then failing to remit it is treated as the worst signal of all.
Which Industries Face the Highest Risk of a Sales Tax Audit?
E-commerce, Software-as-a-Service (SaaS), hospitality, manufacturing and wholesale, multi-state operators, and service businesses face the highest audit risk. Each carries a structural compliance trap: multi-state nexus, murky taxability, high cash volume, or heavy reliance on exemption certificates.
E-commerce sellers juggle multi-state nexus, resale certificate collection at scale, and marketplace versus direct-sale reconciliation. SaaS and subscription businesses face taxability that varies widely by state and unclear sourcing rules. Hospitality and retail run high cash volume and bundled services. Manufacturers and wholesalers misclassify exempt purchases. Service businesses hit state-specific taxability rules where errors are routinely assessed.
How Does Sales Tax Nexus Trigger Audit Exposure?
Sales tax nexus is the linchpin of modern audit exposure, because registering late, or never, after crossing a threshold is the top post-Wayfair audit trigger. Nexus is the connection to a state that obligates you to collect and remit. When a state finds you crossed a threshold years ago and never registered, it can assess every open period at once.
Physical nexus comes from tangible presence: an office, employees (including remote payroll staff), or inventory stored in-state, including Fulfillment by Amazon (FBA) and third-party logistics (3PL) stock. A Secretary of State foreign qualification alone does not create physical nexus. Economic nexus comes from crossing a sales or transaction threshold, most commonly $100,000 in sales or 200 transactions. Affiliate nexus arises through in-state referral or related-entity relationships. Marketplace facilitator laws require platforms like Amazon or Etsy to collect on your behalf, but you may still owe registration and filing, and you must document which sales the marketplace remitted.
Thresholds vary by state, and several states have dropped the transaction-count prong. Some states also count exempt sales toward the threshold, so you can owe zero tax and still be required to register.
| State | Economic nexus threshold | Effective | Source |
|---|---|---|---|
| South Dakota | $100,000 gross sales; no transaction count | July 1, 2023 | South Dakota DOR |
| California | $500,000 sales; no transaction count | April 1, 2019 | CDTFA |
| Texas | $500,000 revenue; no transaction count | Oct. 1, 2019 | Texas Comptroller Rule 3.286 |
| Ohio | $100,000 or 200 transactions (unchanged as of 2026) | Aug. 1, 2019 | Ohio Dept. of Taxation |
| New Jersey | $100,000 or 200 transactions | Nov. 1, 2018 | New Jersey Division of Taxation |
| Georgia | $100,000 or 200 transactions | Jan. 1, 2020 | Georgia DOR |
| Utah | $100,000; 200-transaction prong repealed | July 1, 2025 | Utah State Tax Commission |
| Illinois | $100,000; 200-transaction prong removed | Jan. 1, 2026 | Illinois DOR |
Run a nexus study and register in a state once activity confirms taxable nexus there. Register where you owe, not everywhere, because unnecessary registrations only add filing burden and audit surface.
What Does the Sales Tax Audit Process Look Like Step by Step?
The audit runs a predictable lifecycle: notification, engagement and scheduling, records request, fieldwork, preliminary findings, response and negotiation, final assessment, appeal, and payment. Each stage has deadlines, and the fieldwork stage drives the number.
- Notification. A written notice identifies the audit period, taxes, and requested records.
- Engagement and scheduling. You or your representative respond and negotiate scope and format (on-site, remote, or managed audit).
- Records request (IDR). The Information Document Request (IDR) asks for returns, certificates, the general ledger, POS reports, bank statements, and more.
- Fieldwork. Auditors usually review records by statistical or block sampling rather than examining every transaction. The sampling method is negotiable, and it drives the size of the assessment more than any other single factor.
- Preliminary findings. The auditor issues a proposed assessment.
- Response and negotiation. You rebut findings and supply missing documentation.
- Final assessment. A formal notice states tax, penalty, and interest due.
- Appeal or protest. Deadlines are strict, often 30 to 90 days.
- Payment or settlement. Options include payment plans, a Voluntary Disclosure Agreement (VDA), and managed audits.
What Should You Do When You Receive a Sales Tax Audit Notice?
Read the notice, engage representation, and control what you disclose before you respond. Identify the audit period, tax types, records requested, and the response deadline, which starts running immediately. Then bring in a specialist before anyone at the company talks to the auditor. Do not volunteer records or answers beyond what the notice requests.
Designate one point of contact to funnel all auditor communication. Negotiate scope and logistics, including the sampling method and whether the audit is on-site or managed. Do not sign a statute-of-limitations waiver without representation, because it can extend the years the state may assess.
How Far Back Can a State Audit Sales Tax?
Most states look back 3 to 4 years from the return filing or due date. The lookback becomes unlimited when no return was filed or fraud is involved, which is the trap for unregistered remote sellers who never filed and have no statute protection. Registering “prospectively” while ignoring known prior nexus can be treated as fraud in some states, removing the time limit entirely.
| State | Standard lookback | Extended lookback | Source |
|---|---|---|---|
| California | 3 years | 8 years if no return filed; unlimited for fraud or intent to evade | CDTFA (R&TC §6487) |
| New York | 3 years from filing | Unlimited for non-filers and false or fraudulent returns | New York DTF, Pub. 130-F |
Auditors routinely ask businesses to sign a statute waiver to extend the audit period. Signing one lets the state assess years it would otherwise be barred from touching, so treat it as a negotiation, not a formality. For a state-by-state breakdown, see Commenda’s sales tax audit statute-of-limitations guide.
What Penalties Can a Sales Tax Audit Result In?
An assessment stacks three charges: back tax, interest running from the original due date, and penalties. Because sales tax is a trust-fund tax, meaning you collect it from customers on the state’s behalf, states punish non-remittance harder than income tax underpayment. Penalty rates are set by state statute and vary, so the ranges below are typical, not fixed.
| Charge | Typical range | Source |
|---|---|---|
| Interest on unpaid tax (from original due date) | ~3%–12% annually | State DOR interest-rate schedules (e.g., California CDTFA, New York DTF) |
| Failure-to-file or late-filing penalty | ~5%–10% of tax due | State DOR penalty statutes |
| Negligence penalty | ~10% of tax due | State DOR penalty statutes |
| Civil fraud or intentional evasion penalty | 25%–50%+ of tax due | State DOR penalty statutes |
Can owners and officers be personally liable?
Yes. Responsible-person statutes in many states let the state pierce the corporate veil and hold owners, officers, and sometimes controllers personally liable for uncollected or unremitted trust-fund sales tax. Because the tax was collected on the state’s behalf, personal liability can survive the business itself, even after a company closes or files for bankruptcy.
When does a sales tax audit become criminal?
A sales tax audit becomes criminal when the state finds intentional evasion or fraud, not honest error. Deliberately collecting tax and keeping it, filing false returns, or hiding sales can bring criminal prosecution on top of civil fraud penalties. Criminal exposure is reserved for willful conduct, but it is the reason evasion is treated as categorically different from an underpayment.
What Documents Do Auditors Request in a Sales Tax Audit?
Auditors request filed returns, invoices, exemption and resale certificates, and purchase records, plus the deeper IDR scope: general ledger, POS reports, bank statements, and fixed asset ledgers. The goal is to reconcile every source against your filings and test each exempt sale.
Exemption and resale certificates are where auditors hit hardest, and missing or expired certificates are the most common reason businesses fail. Keep a valid, unexpired certificate for every exempt sale, organized by delivery state, per Commenda’s guide to sales tax exemption certificates. Some states do not accept out-of-state resale certificates, so confirm the rules in each state you sell into using this list of states that reject out-of-state resale certificates.
How Does Use Tax Create Audit Exposure?
Use tax applies to taxable purchases where the vendor charged no sales tax, and it is a routine source of assessments. Auditors examine the purchase side as closely as the sales side, because businesses forget to self-assess use tax on out-of-state and online purchases. In business-to-business audits, use tax is often where the largest deficiency is found.
For example, a California business that buys equipment from an Oregon vendor pays no sales tax at purchase, because Oregon has no sales tax. That business must self-assess and remit California use tax on the equipment. Failing to do so is a straightforward assessment for an auditor examining purchase invoices and the fixed asset ledger.
How Do You Prepare for a Sales Tax Audit?
Preparation is continuous, not reactive. Before any notice arrives, keep clean records, current registrations, complete exemption certificates, and monitored nexus across every state where you sell. The businesses that survive audits cleanly are the ones that treated compliance as an ongoing process, not a fire drill.
Ecommerce sales tax audit checklist
- Monitor nexus in every state where you ship, using each state’s own gross-versus-taxable-sales definition.
- Separate marketplace-facilitated sales from direct-channel sales, so you are not assessed on tax the marketplace already remitted.
- Map FBA and 3PL inventory locations, because stored inventory creates physical nexus.
- Collect and store valid resale certificates for every wholesale buyer, by delivery state.
SaaS sales tax audit checklist
- Map product taxability state by state; SaaS is taxable in roughly 20-plus states and exempt in others.
- Source revenue by customer location using each state’s rule (bill-to, ship-to, or user location).
- Document exemptions for resellers and exempt entities.
- Register where you have crossed thresholds, including states that count exempt sales toward the threshold.
What Are the Best Sales Tax Audit Defense Strategies?
The best defense is engaging representation early and negotiating the sampling method before fieldwork begins. A flawed sample extrapolated across the audit period can inflate an assessment dramatically, so this is where the biggest reductions happen.
Rank your tactics in order:
- Engage audit representation early, so a specialist takes power of attorney and deals with the state directly.
- Negotiate the sampling method before fieldwork starts.
- Cure gaps by obtaining missing exemption certificates during the response window, which many states allow.
- Rebut preliminary findings in writing, including auditor over-assessments on genuinely exempt items.
- Use a VDA or managed audit for known unregistered exposure before a state makes contact.
- Meet every appeal and protest deadline to preserve your rights.
How Commenda Helps You Prepare for a Sales Tax Audit
Commenda’s global indirect tax software tracks your physical and economic nexus across all states, manages your registrations and filings, and keeps exemption certificates audit-ready, so a state auditor never surfaces exposure you did not already know about. That is certainty: you know where you owe, what is filed, and that it got done.
Use Commenda’s US nexus exposure guide to monitor thresholds by state, and the sales tax calculator to look up current rates. Book a demo call to get your free nexus exposure assessment before a state auditor runs one for you.
