What to do when you get a sales tax audit notice

A letter from a state tax authority isn’t anyone’s idea of a good morning. But it’s also not the end of the world.

Sales tax audits happen. They happen to well-run businesses that grew faster than their compliance setup. They happen when a platform switch doesn’t carry over the right tax settings. They happen when a previous accountant wasn’t tracking nexus the way they said they were.

When you receive an audit notice from a state Department of Revenue, you have 30 to 45 days to respond. The decisions you make, and the things you don’t say before you’re ready, will shape how this goes.

Here’s the plan.

Dealing with a sales tax audit: Your 48-hour action plan

Once a notice arrives, you have 30 to 45 days to respond. Here is what to do in the first two days.

Step 1: Read the notice. It may not be a full audit.

Before you call anyone, read the notice. The whole thing.

Not every audit notice is a full audit. Some are nexus questionnaires. The state uses these to determine whether you have an obligation before opening a formal audit. Responding to a questionnaire as though it’s a full audit, or vice versa, creates complications that didn’t need to exist.

Once you’ve confirmed it’s real, note four things:

1. The legal entity named
2. The state issuing the audit
3. The audit period covered
4. The response deadline

Step 2: Mark the deadline in your calendar

Most states give you 30 to 45 days to respond. That’s not a lot of runway, and missing it has real consequences.

If you miss the deadline, the state can issue an estimated tax assessment. That means they calculate what they think you owe, including penalties, without your input. Disputing an estimated assessment is harder than disputing your actual records.

Mark the date. Set a reminder.

Step 3: Contact your compliance provider before you respond to anyone

Before you pick up the phone to call the auditor, talk to your compliance provider or a sales tax professional.

Scope, timeline, and sampling methodology are all negotiable before the audit formally begins. Once you start talking to the auditor on the record, those windows close. You don’t want to give up negotiating room you didn’t know you had.

A sales tax professional can lock in favorable audit parameters before the process gets underway. After it starts, that conversation gets much harder.

Step 4: Start gathering your records now

Auditors will ask for records. For ecommerce businesses, those records are usually spread across multiple systems: your platform, payment processor, marketplace accounts, and accounting software.

Start pulling them before you know exactly what the auditor needs. A data export that takes two weeks can cost you a deadline.

Records to start gathering now:

• Sales tax returns filed during the audit period
• Transaction-level sales data (exportable from Shopify, WooCommerce, and most platforms)
• Exemption certificates and resale certificates
• Marketplace records showing facilitator-collected tax (Amazon, Etsy, etc.)
• Bank statements covering the audit period
• Nexus documentation and registration records

If you’re a TaxCloud customer, most of your filing history is already organized in your account. That’s one less thing to chase down.

Step 5: One person handles all revenue auditor communication

Pick one point of contact. That’s you, your tax professional, or your compliance provider. Not all three.

Inconsistent communication expands audits. Auditors follow up on discrepancies, and discrepancies come from multiple people giving different answers. If you bring in a professional, this typically means granting them power of attorney to respond on your behalf.

Once you’ve taken these steps, the audit process formally begins. The sections below cover what auditors are actually looking for and how to handle communication once things are underway.

Why ecommerce businesses get audited

Audit notices aren’t random. If you’re not sure what triggered yours, one of these three situations usually explains it.

1. You triggered nexus in a state without realizing it. Economic nexus typically kicks in when you cross an economic nexus threshold (e.g. $100,000 in revenue or 200 transactions in a year). Physical nexus kicks in the moment you have a warehouse, inventory, or employees there. Either way, if the obligation to collect, file, and remit sales tax existed in a state and you kept selling there, you’ll eventually get an audit notice in the mail. Many ecommerce businesses have been filing correctly in some states for years while unknowingly owing in others. TaxCloud’s economic nexus tracking helps you see where you’ve crossed the threshold before a state comes looking.
2. You thought someone else was handling compliance — and they weren’t. A previous employee, accountant, or system dropped the ball, and you’re only finding out now. Approach the audit without shame. Focus on what you can document. Delays caused by reluctance to engage make the outcome worse.
3. One state asked questions. Others will follow. States share information. An audit in one state can trigger inquiries in others where your filing history looks similar. This is how most multi-state audit situations begin.

What sales tax auditors are actually looking for

A sales tax audit isn’t a single question. It’s several. Auditors work through your returns, records, and documentation looking for gaps between what you should have collected, what you did collect, and what you actually remitted.

For ecommerce businesses, these are the areas that come up most often.

• Whether you were registered where you had an obligation. If you triggered nexus threshold in a state but never registered, that gap is likely what triggered the audit. Auditors cross-reference your sales data against your registration history. Gaps are easy to spot.
• Whether you taxed the right things. Product classification errors are one of the most common audit findings. Vague or inconsistent descriptions make it easy for auditors to reclassify items you intended to exempt as taxable. Every exempt sale needs a complete, valid exemption certificate on file.
• Whether your marketplace sales are properly documented. If you sell through Amazon or Etsy, those transactions are typically handled under marketplace facilitator laws. You’re generally not liable for tax on those sales — but you need records proving the marketplace collected and remitted it. Keep marketplace reports separate from your direct sales data.
• Whether what you collected matches what you remitted. Your transaction records, bank statements, and filed returns need to tell a consistent story. Discrepancies between what was collected and what was remitted are a red flag.

Keep in mind, auditors don’t review every transaction. They test a sample and project the error rate across your full audit period. One misclassified product type in a sample becomes a significant liability when extrapolated across years. The sampling methodology is negotiable before the audit begins. It is not negotiable after.

How to communicate with the auditor

The honest answer: ideally, you don’t. Auditor communication is best handled by your compliance provider or a SALT professional who knows what’s negotiable, what creates a paper trail, and what inadvertently expands scope.

If you’re a TaxCloud customer and you’re paying for TaxCloud’s sales tax audit support services, the first step is to contact the TaxCloud team and share the notice or correspondence you’ve received from the state.

From there, a TaxCloud team member who is familiar with your account and compliance history will review the details, help assess the situation, and advise you on next steps.

If you’re managing audit communication yourself, these rules matter.

Answer what’s asked. Nothing more. Being forthcoming feels right. In an audit it usually isn’t. Volunteering information gives auditors more to follow up on and can expand the scope of the audit.

Confirm everything in writing. After any call or meeting, send a written summary to the auditor confirming what was discussed. A confirmation creates a record you control.

Request extensions in writing. If you need more time, ask before the deadline passes. Most states will grant at least one extension. Don’t assume it’s automatic, and get the confirmation in writing.

Watch for statute of limitations waivers. Auditors sometimes ask businesses to sign these. A reasonable, time-bound extension isn’t automatically bad — it can give both sides room to reach a resolution. But read it carefully and get professional input before signing anything.

How TaxCloud supports customers during a sales tax audit

If you’re already a TaxCloud customer, you have protections built into your account that most ecommerce businesses don’t.

In SST states TaxCloud is a Certified Service Provider (CSP) under the Streamlined Sales Tax (SST) program. If you’re eligible to participate in the Streamlined Sales Tax Program, and you’re audited by one of the 24 SST-participating states where you have no physical presence, the state contacts TaxCloud, not you. We handle it.

That’s not an add-on — it’s built into your plan.

If you’re on a platform that isn’t an SST-certified CSP, this protection doesn’t exist. Audit exposure sits entirely with your business.

In non-SST states TaxCloud offers audit support as an add-on for $99 per month. Our team handles auditor communication, gathers documentation, and puts together a complete submission portfolio. U.S.-based support, available when you need it.

If you weren’t enrolled before the notice arrived, talk to your account team. It may not be too late.

Audits are manageable. The businesses that end up in serious trouble are the ones that wait, don’t respond, or try to navigate it without knowing what’s actually negotiable.