TL;DR

States no longer pull audit targets at random. Data analytics flag businesses, and the pattern is predictable.

• Triggers cluster around unregistered nexus, certificate gaps, and data mismatches between your returns and third-party reports.

• Auditors examine nexus establishment dates, exemption certificate validity, and the tax you applied versus what you owed.

• Documentation falls into six categories you should have ready before a letter arrives.

• State processes differ across California, Texas, and New York, especially on how far back each can reach.

• Automation closes the gaps that produce findings, and Taxwire runs the whole readiness function as a managed service.

What Triggers a Sales Tax Audit

States select audit targets through data analytics, not random selection, and six patterns drive most of those selections.

Unregistered economic nexus. You cross a state's sales or transaction threshold but never register or start collecting tax. States track this through marketplace settlement data and payment processor reporting, so the gap surfaces without you reporting it. Economic nexus commonly triggers at $100,000 in sales or 200 transactions, though thresholds vary by state.

Exemption certificate gaps. You claim exempt sales without valid certificates on file, or your certificates are expired or incomplete. A high ratio of exempt sales paired with weak certificate management is a named selection criterion. Missing, expired, or invalid certificates rank among the top reasons businesses get audited.

Data mismatches. Your sales tax returns disagree with your income tax gross receipts, your marketplace reports, or your 1099-K totals. Auditors compare these data sets first, and any discrepancy invites a closer look.

Filing inconsistencies. You file late, miss returns, or report zero activity in periods where third-party data shows sales. Irregular filing patterns flag your account for review.

M&A and rapid growth. Fast growth often creates nexus before you register, and acquisitions inherit the seller's compliance gaps. States rate both as elevated risk.

Prior audit history. A past underpayment raises your risk score. Some states run follow-up audits every three to five years on businesses that were previously noncompliant.

Customer and competitor complaints sit alongside these triggers. States initiate audits based on informal tips, so a disgruntled buyer or rival can put you on the list.

One claim circulates widely and deserves caution. A failed or rejected voluntary disclosure agreement is often described as an audit trigger, but no primary-source state guidance in our research supports that causation. The Texas Comptroller and the MTC both describe the reverse, where audit contact disqualifies a VDA. Treat the failed-VDA-as-trigger claim as unconfirmed.

What Auditors Look For

An auditor's job narrows to three questions about your business. When did you establish nexus in each state, are your exemption certificates valid, and does the tax you applied match the tax you owed? Every document request and ledger cross-check ties back to one of those three.

Nexus establishment dates come first because they set the boundary of the audit. Auditors pull your registration confirmations, effective registration dates, and economic nexus threshold calculations to find the exact period you should have been collecting tax. If you registered late, that gap becomes the assessment.

Exemption certificate validity decides whether your tax-free sales survive scrutiny. Each certificate must carry the buyer name, address, reason for exemption, and state-issued registration number under Streamlined Sales Tax Governing Board standards. A missing or expired certificate means the state treats that sale as taxable and bills you the full amount plus penalties and interest.

Transaction-level review compares the tax you charged against the tax you should have charged. Auditors verify total sales, taxable versus exempt sales, and tax collected against order numbers, line items, and shipping charges. They rarely examine every record. Most states apply statistical sampling, pulling high-volume periods and the top transactions over a dollar threshold, then extrapolating the error rate across the full population (Thomson Reuters).

Weak documentation is what turns a sample error into a large bill. Gaps in your records hand the auditor room to assume the worst.

Sales Tax Audit Documentation Checklist

When an audit letter arrives, an auditor gives you a date to produce records and expects you to meet it. The companies that survive audits cleanly already have these documents organized before the request lands. Work through this checklist by category and confirm you can produce each item on demand.

Nexus Records

• State registration approvals and permit numbers for every state where you collect

• The effective date of registration for each permit

• Economic nexus threshold calculations and the dates you crossed each one

• The filing frequency each state assigned you

Exemption Certificates

Auditors treat a missing certificate as a taxable sale and assess full tax plus penalties and interest. Every certificate you hold must carry the fields required under Streamlined Sales Tax Governing Board standards: buyer name, address, signature, tax ID, exemption type, state of issuance, and the buyer's permit number.

• Valid resale certificates for buyers purchasing to resell

• Exemption certificates for nonprofits, government, and other exempt buyers

• Certificates organized by customer and state, with expiration and renewal tracking

Sales Tax Returns and Filing History

• Filed returns showing gross sales, taxable sales, deductions, adjustments, and total tax due

• Payment confirmations for each state and period

• Zero returns for periods with no taxable sales

Transaction Data

• Invoices, receipts, and POS reports with order numbers, line items, shipping charges, and tax applied

• General ledger and supporting accounting records that reconcile to your returns

Marketplace Facilitator Reports

• Monthly or quarterly settlement reports from Amazon, Etsy, and Walmart showing platform-remitted tax

• Reconciliation against your direct sales so the same revenue is not reported twice

Product Taxability Records

• Internal documentation of how each product is classified and your mapping rationale by state

Keep these records for at least four years as a baseline, though the exact retention period depends on the state. Statute of limitations windows vary by jurisdiction and decide how far back an auditor can reach, so a four-year file may not cover you in a state with a longer lookback. When you are unsure, retain longer rather than shorter.

How a Sales Tax Audit Works in California

The California Department of Tax and Fee Administration (CDTFA) runs sales and use tax audits across the state, examining whether you collected, reported, and remitted the correct tax on every taxable sale and purchase. The agency audits roughly 1% of active tax accounts each year and uncovered around $477 million in net deficiencies in a recent fiscal year, per CDTFA audit data. At that scale, selection is rarely random. The CDTFA targets accounts with high exempt-sales ratios, filing gaps, or data that conflicts with marketplace and 1099-K reporting.

An audit opens with a letter naming the audit period and an examiner assigned to your account. The CDTFA then sends a document request package. Expect to produce filed returns with payment proof, your general ledger and trial balance, federal income tax returns for the period, sales detail split by taxable and exempt, every resale and exemption certificate claimed, and your nexus location records. Examiners reconcile these against each other. A gap between your reported taxable sales and your federal gross receipts is one of the first things they flag.

Penalties and interest

California applies a 10% penalty for late filing or late payment, and quarterly prepayment filers face an additional 6% late-prepayment penalty on top of that (CDTFA penalty structure). Interest accrues separately and compounds the cost. A clean account that simply paid late still absorbs the 10% hit. An account with material underreporting absorbs the penalty plus interest on the full assessed deficiency.

How far back the CDTFA can reach

The lookback window depends on whether you filed and how the examiner views your records, and the exact statutory periods come straight from the agency itself. The CDTFA publishes its audit guidance and statute-of-limitations rules at cdtfa.ca.gov, and you should confirm your specific window there before assuming any figure. Advisory sources suggest the state can reach back roughly eight years for non-filers, but treat that as a planning estimate rather than a primary-sourced rule. The practical takeaway is direct. If you never registered, the open period stretches far longer than the window a registered filer with clean records would face, so the cost of staying unregistered compounds with every passing year.

How a Sales Tax Audit Works in Texas

The Texas Comptroller of Public Accounts runs sales and use tax audits across the state, and the agency tracks nexus through marketplace settlement data, employee locations, and inventory held in fulfillment warehouses. An audit usually opens with a notification letter and a request for your returns, ledgers, exemption certificates, and sales detail by jurisdiction. Once that letter lands, your options for resolving past liability narrow sharply.

The notification letter itself closes the door on a voluntary disclosure agreement. Texas Comptroller Publication 96-576 requires that a taxpayer "has not received a notification of an audit or examination" to qualify for a VDA. The causation runs one direction. Audit contact disqualifies the VDA, so a business sitting on unregistered nexus loses its cleanest path to limited penalties the moment the Comptroller makes contact. If you suspect exposure in Texas, the time to act is before any letter arrives.

A completed VDA does not give you permanent cover either. Publication 96-576 states that "report periods included in the VDA remain open to future audit, within the statute of limitations." An accepted agreement waives penalties and caps the lookback, but it does not seal those periods. The Comptroller can still examine a VDA period and assess additional tax if the original disclosure understated what you owed. Accurate data at the disclosure stage protects you twice.

Penalties and interest in Texas

Texas penalizes late payment on a tiered schedule. A payment that is 1 to 30 days late carries a 5% penalty, and a payment more than 30 days late carries a 10% penalty, with interest accruing after 60 days, per Comptroller-attributed data. On a multi-state company with several years of underreported tax, that 10% tier compounds across every period the auditor reopens.

Statute of limitations in Texas

Texas applies a lookback window to how far back the Comptroller can assess, and that window expands when returns are missing or fraud is alleged. The exact year count for Texas should be confirmed directly against the Texas Comptroller before you rely on it, because the figure governs how many years of records you must keep ready. Pull the current statute from the Comptroller's audit pages rather than a secondary summary.

How a Sales Tax Audit Works in New York

The New York Department of Taxation and Finance audits sales and use tax under Tax Law § 1083, applied through Articles 28 and 29, with assessment authority that scales directly to how complete and accurate your filings are. The DTF runs its audits out of its district offices and pulls from the same standard document request package other states use, including filed returns, the general ledger, every claimed exemption certificate, and marketplace settlement reports.

The standard assessment window runs three years from the date you file a return. File early and the clock does not start sooner. A return submitted before its due date is deemed filed on the due date, so early filing never shortens the three-year period (Tax Law § 1083; DTF Publication 131).

Two exceptions stretch that window, and DTF auditors know how to reach for them. The window extends to six years when a taxpayer omits more than 25% of taxable sales or income from a return, or for transactions the state deems abusive. When no return is filed at all, or when a false or fraudulent return is filed with intent to evade, the DTF can assess at any time with no limitation period (Tax Law § 1083; DTF Publication 131).

That open-ended fraud exception is where audit defense gets serious. DTF auditors argue the 25% omission threshold applies whenever your records look incomplete or your reported sales do not match outside data. Bank deposit totals that exceed reported taxable sales, 1099-K figures that contradict your returns, or resale certificates the auditor judges invalid all give the DTF a basis to invoke the six-year rule under Publication 131 or allege fraud to remove the limitation entirely.

Your records are the defense against an inflated window. Reconcile your bank deposits to your reported sales before the auditor does it for you. Confirm every resale and exemption certificate on file is complete and valid, because an invalid certificate is one of the fastest ways an auditor justifies a longer lookback.

New York Publication 116 recommends keeping four years of complete records. Treat that as a floor, not a ceiling. If your filings could trigger the 25% omission test, the DTF can reach back six years, and four years of documentation will not cover the period the auditor is examining.

How Automated Compliance Software Reduces Audit Risk

The penalty math favors the companies that automate. Roughly half of under-resourced tax departments incurred penalties over the past year, against just one-third of adequately-resourced ones, per the 2025 State of the Corporate Tax Department Report. A single audit can run into tens of thousands of dollars in penalties, interest, and outside counsel fees. The gap between the two groups comes down to whether the underlying compliance work runs on spreadsheets or on a rules-based engine.

Manual calculation breaks down under scrutiny because the math itself is unreliable. 88% of spreadsheets contain errors, and 41% of reporting errors trace back to human input. A determination engine applies jurisdiction-specific rates in milliseconds based on product taxability and customer location, which means an auditor sampling your high-volume transactions finds consistent treatment rather than scattered mistakes.

Certificate tracking is where exempt sales turn into assessments. Manual processes capture certificates without monitoring expiry by jurisdiction, so a lapsed form sits in a folder until an auditor finds it. Automated systems capture, store, and validate certificates per jurisdiction and flag expirations before the certificate goes stale, which removes the single most common source of disallowed exemptions.

Filing history completeness decides how defensible your records look on day one of an audit. A mid-sized business across 10-plus states spends 15 to 20 hours a month on rate research and reconciliation under manual processes, and that effort still leaves gaps. Automated systems maintain a transaction-to-report trail described as consistent and defensible, so you can trace any line item from its imported date through the final return without reconstructing the path by hand.

Nexus monitoring fails manually because the question changes faster than a person can track it. Tax rates and rules change thousands of times a year across U.S. jurisdictions, and economic nexus thresholds shift as your sales grow. Automated software tracks those thresholds in real time and triggers compliant calculations the moment you cross one, which closes the unregistered-nexus exposure that auditors target first.

How Taxwire Supports Audit Readiness

Taxwire runs your sales tax compliance as a managed service backed by an in-house tax team, which means a licensed professional answers the auditor instead of a controller scrambling through spreadsheets. The resourcing gap described above is real and measurable. A managed team closes it without requiring you to hire a full tax department.

Taxwire maintains your complete filing history across every state where you collect, so the transaction-to-return trail an auditor demands already exists when the notice arrives. Earlier sections showed how California auditors pull statistical samples and how New York can stretch a three-year window to six when records look incomplete. A continuous, reconciled filing record removes the gaps that trigger those extensions and the larger assessments that follow.

Certificate management sits inside the same service. Taxwire captures, stores, and validates exemption certificates per jurisdiction and tracks expiration dates before they lapse. Missing or invalid certificates are one of the most common reasons exempt sales get reassessed as taxable, and a New York auditor can use invalid certificates to justify the six-year rule. Keeping every certificate current and retrievable closes that exposure directly.

For companies that already carry back exposure, Taxwire handles voluntary disclosure agreements and back-filing. Unregistered economic nexus is a top audit trigger, and the longer a state's lookback runs, the larger the liability. A VDA caps that lookback and waives penalties, but only if you reach the state before an audit contact disqualifies you. Taxwire scopes the exposure, files the agreement, and brings the periods current before a state finds you first.

If you operate across multiple states and want your filing history, certificates, and nexus position audit-ready before a notice arrives, talk to Taxwire about a compliance review.

Frequently Asked Questions

What triggers a sales tax audit? States flag businesses using data analytics that compare your filed returns against marketplace reports, 1099-K data, and processor records. Common triggers include crossing an economic nexus threshold without registering, high exempt-sales ratios with weak certificate management, and filing inconsistencies. Rapid growth and acquisitions also raise your risk rating because both tend to create nexus before registration catches up.

How far back can a state audit? The lookback window depends on your filing status and the state. A registered filer with clean returns typically faces a shorter window than a non-filer, who can be assessed back to the start of nexus. Each state sets its own statute of limitations, so check the relevant Department of Revenue page for your specific window.

What documents should I have ready? Keep filed returns with payment proof, your general ledger, transaction-level sales records, and every exemption certificate you claimed. You should also retain nexus registration records and marketplace settlement reports. Most states expect at least four years of complete records.

What happens if I have missing exemption certificates? The state assumes the sale was taxable and assesses the full tax plus penalties and interest. Collect valid certificates before processing any tax-free sale to avoid this.

Can I use a VDA after receiving an audit notice? No. Once a state contacts you about an audit, you are barred from a voluntary disclosure agreement for that tax type.