A sales tax audit runs in two directions, and most companies prepare for only one of them. There is the audit a state runs on you: an auditor arrives, pulls your returns and purchase records, and tests whether you collected, remitted, and self-assessed what the law required. And there is the audit you should be running on yourself: a structured sales and use tax audit of your own systems, vendors, and classification decisions, conducted before anyone with assessment authority does it for you.
Tax and finance teams invest heavily in surviving the first kind. Very few ever conduct the second. That gap is where money accumulates, usually in the state’s favor, because state auditors are trained to find underpayments. Nothing in an auditor’s work papers is designed to surface the tax you overpaid.
This guide covers both directions: how state audits get selected and how they unfold, how to validate your own sales tax system before a state tests it, how reverse audits recover the overpayments that validation surfaces, and how to build a program that keeps both kinds of exposure under control.
What is a sales tax audit?
A sales tax audit is a formal examination of a company’s sales and use tax records to verify that tax was correctly charged, collected, remitted, and paid. State revenue agencies conduct them to find underpayments. Companies can also initiate their own version, a reverse audit, to find overpayments the state will never point out.
Practitioners often shorten the discipline to SUT audit, and the “U” matters. Every audit of a large organization examines two distinct populations of transactions. On the sales side, the question is whether you charged and collected the right tax from your customers, and whether the exempt sales you did not tax are backed by valid documentation. On the purchase side, the question is whether you paid the right tax to your vendors and self-assessed use tax where vendors did not charge it.
For manufacturers, energy companies, and other capital-intensive purchasers, the purchase side is where most audit assessments originate, and it is also where most overpayments hide. The same complexity cuts both ways. That symmetry is the central idea of this guide: underpayment exposure and overpayment loss are two sides of one validation problem, and a company that only ever examines one side is running half an audit program.
The state-initiated sales tax audit: triggers, process, and penalties
A state sales tax audit typically begins with a written notice, covers a three-to-four-year lookback period, and takes several months to more than a year to complete. Auditors test both the tax you collected from customers and the use tax you self-assessed on purchases, then issue an assessment carrying interest and, often, penalties.
States select audit candidates deliberately. Selection models weigh industry, company size, exemption-heavy returns, refund claims, and the productivity of your last audit. Data matching plays a growing role: agencies compare returns against customs records, federal filings, and the work papers of your vendors’ audits, where your company’s untaxed purchases may already be listed. Footprint growth is a trigger of its own. Since the Supreme Court’s 2018 Wayfair decision expanded nexus beyond physical presence, companies registering in new states have given more agencies a reason to look.
The stakes are not abstract. California’s audit program alone disclosed $518.8 million in sales and use tax deficiencies in fiscal year 2023-24, returning roughly four dollars for every dollar the state spent on it, according to the California Department of Tax and Fee Administration. Programs with that kind of yield do not shrink.
The process itself is predictable. You receive a notice and records request covering returns, general ledger detail, invoices, and exemption certificates. An opening conference sets scope and sampling methodology, and that sampling agreement deserves real scrutiny, because an error rate found in a sample will be projected across the entire audit period. Fieldwork follows, then preliminary schedules, an exit conference, a window to respond with documentation, and a final assessment you can contest through administrative appeal and, if necessary, litigation.
Lookback periods are set by statute. Texas, for example, generally cannot assess tax more than four years after it became due under Texas Tax Code Section 111.201, and most states hold to a similar three-to-four-year window. The window extends if you sign a waiver, which auditors routinely request and you should evaluate rather than rubber-stamp, and it disappears entirely for unfiled returns or fraud. Penalties commonly run around 10 percent of the assessed tax for negligence, with fraud penalties of 25 percent or more, plus interest that accrues from the original due date.
One structural point matters more than any procedural detail: the audit is one-directional. Some states allow overpayment credits to offset an assessment if you identify them during fieldwork, but no auditor’s workplan is built to find them for you. A full preparation playbook, including what to do in the first 30 days after a notice arrives, is in our guide to sales tax audit defense.
The self-initiated audit: how to validate your sales tax system
Validating your sales tax system means testing whether your tax logic, vendor tax applications, and classification decisions are producing correct results across current transactions and jurisdictions. It is a structured review you initiate, not a reprocessing of every invoice, and it examines both directions of error: tax you overpaid and liabilities you have not accrued.
Why well-run systems drift
Most large organizations have invested heavily in sales and use tax infrastructure. ERP systems are configured, tax engines are implemented, returns are filed with discipline. The system executes its logic consistently across high transaction volume, and that consistency is a strength. The problem is that the business around the system never stands still.
Organizations expand into new jurisdictions. Vendors change, and every new vendor brings its own read on what to tax. Employees transition out of tax and procurement roles, taking undocumented judgment with them. ERP systems get upgraded. Capital projects introduce classification complexity, with taxable and non-taxable items purchased from the same vendors, frequently within the same invoice stream. Tax law and its interpretation evolve underneath all of it.
None of these changes announces itself as a tax problem. Each one quietly alters how transactions flow through logic that was correct when it was written, and the resulting discrepancies accumulate across large vendor bases and multi-year projects even where tax controls are mature.
What a validation review tests
A structured validation works through four questions. Are classification decisions aligned with current statutes and rulings, not the ones in force when the tax matrix was built? Are vendors applying tax correctly and consistently, or does the same item arrive taxed from one vendor and untaxed from another? Are the tax matrices and rules inside your systems functioning as intended after every upgrade and patch? And are high-risk categories behaving consistently across jurisdictions?
Effective validation deliberately considers both sides of the equation, potential overpayments and potential liabilities, because they share the same root causes. The objective is not disruption. It is clarity. Where controls are sound, validation confirms it, and that confirmation has standalone value for a tax leader who has to attest to the function’s health. Where small inconsistencies have accumulated, validation surfaces them before a state auditor does, or before the statute of limitations quietly retires your refund rights.
Where to focus
Certain environments concentrate classification complexity and deserve first attention:
- Multi-state manufacturing operations
- Construction and capital-intensive projects
- Operations with high vendor or employee turnover
- Mixed-use purchases combining equipment, materials, and labor
- Recent ERP conversions or major system updates
In these environments, gray areas are the norm. Not every transaction fits neatly into a statute, and applying tax law to real operations requires interpretation. Those interpretations need to be defensible and consistently applied, which is precisely what drift erodes.
A practical starting point
Before commissioning anything, four questions establish whether a validation is due. When was the last time your tax system’s logic was formally reviewed? Have operational changes altered how transactions flow through it? Are you relying on vendor-applied tax without secondary verification? And do you know your materiality thresholds and the exposure that sits beneath them?
Validation does not need to be disruptive. Scope can be structured around material categories and the high-risk areas above, keeping the effort manageable while targeting the transactions where exposure concentrates. Many organizations bring in an independent reviewer at this stage, particularly when transaction volume makes a thorough internal review impractical alongside day-to-day responsibilities. Separating system execution from system review also strengthens the objectivity of whatever the review finds.
What results look like
Validation results routinely surprise even sophisticated tax teams. In one engagement, a semiconductor manufacturer engaged Revenew to review sales and use tax paid during the construction of a major fabrication facility, expecting perhaps $1 to $1.5 million in recovery. The review identified roughly $15 million, more than ten times the client’s internal estimate. The discrepancy did not come from system failure. It reflected the cumulative effect of vendor turnover, classification gray areas, and transaction complexity across a multi-year project. The items involved were purchases the tax team already knew well. They had simply been taxed inconsistently, across vendors and over time.
Reverse audits and recovery: getting overpayments back
A reverse sales tax audit is a review you commission to find tax your company overpaid: exempt purchases that were taxed, use tax accrued on transactions where vendors also charged tax, rates applied by the wrong jurisdiction. Recoveries come back through refund claims or vendor credits, subject to each state’s statute of limitations.
The name describes the direction. A state audit is something that happens to you; a reverse audit is something you initiate, and preparing for one materially improves your position in the other, because both examine the same records. A full definition and walkthrough is in our explainer on what a reverse sales tax audit is, and if you are weighing terminology, the distinction between the tax-specific review and the broader payment discipline is covered in reverse audit vs. recovery audit. The same recovery logic extends past tax altogether: duplicate payments and supplier overcharges respond to the identical discipline, which is the subject of our accounts payable audit guide.
The statute of limitations makes timing a direct financial variable, not an administrative footnote. Refund rights expire on the same three-to-four-year clock that limits assessments, and every filing period that ages out takes its refund claims with it. One engagement makes the point concretely. A leading global food manufacturing company, with roughly $50 billion in U.S. revenue and operations in 34 states, engaged Revenew in 2022 expecting a couple million dollars at most. The review identified nearly $34 million in available refunds across eight states, and the first state’s refund claim was approved at 100 percent. Because of the statute of limitations, every month that passed before the work started had been costing the company at least $1 million in expiring claims. That figure is an engagement outcome, not a promise, but the mechanism behind it applies to any multi-state purchaser: overpayments age out silently.
The most common sales tax failure points
Most sales tax errors trace to four sources: overpayments on purchases that were exempt or misclassified, missing or expired exemption certificates, confusion between sales tax and use tax obligations, and automation that was configured once and never revisited. Each compounds quietly, because standard compliance processes are built to file returns, not to question them.
Overpayments on purchases
Vendors default to charging tax when taxability is unclear, and accounts payable teams default to paying the invoice as rendered. Exempt manufacturing equipment, items purchased for resale, and utilities consumed in production all routinely arrive with tax applied, and the charge passes through untouched. The causes are recurring and recognizable; we catalog them in common causes of sales tax overpayments.
Exemption certificate gaps
Certificates fail in both directions. On the sales side, a missing, expired, or wrong-form certificate converts a legitimately exempt sale into assessable tax during an audit, with your company holding the liability. On the purchase side, failing to issue certificates to vendors guarantees you are billed tax on exempt purchases. Certificate management is unglamorous and decisive, and our guide to exemption certificate management covers how to run it as a process rather than a filing cabinet.
Sales tax vs. use tax confusion
The two taxes are complementary, but the obligations sit with different parties and fail in different ways. Companies underpay when no one self-assesses use tax on untaxed purchases, which is the single largest source of audit assessments for large purchasers. They overpay when the vendor charges tax and the company accrues use tax on the same transaction. If the distinction is blurry anywhere in your organization, start with sales tax vs. use tax.
Automation configured once, never revisited
Tax engines execute the logic they are given, and they will execute outdated logic with the same efficiency as current logic. Rate updates are the easy part. Mapping decisions, taxability matrices, and exemption logic age as the business and the law change, and there is a lot of law to track: Tax Foundation analysis counts more than 11,000 state and local sales tax jurisdictions in the United States. Software is necessary and not sufficient; compliance is not just filing on time, it is also not overpaying, and automation optimizes for the first. What the tools systematically miss is the subject of sales tax automation: what it misses.
Building an ongoing sales tax compliance program
An ongoing sales tax compliance program pairs the routine work of registration, calculation, and filing with scheduled validation of the decisions underneath them. That means keeping tax matrices current, monitoring nexus as operations expand, managing exemption certificates continuously, and formally reviewing system logic every 18 to 24 months or after major operational change.
The routine layer is well understood: registrations, filing calendars, reconciliations, and rate maintenance. The validation layer is what most programs lack. A review cadence of every 18 to 24 months, accelerated after ERP conversions, entry into new jurisdictions, major capital projects, or significant vendor and personnel turnover, catches drift while claims are still inside the statute of limitations and before errors compound into audit exposure.
Simplification efforts help at the margins. The Streamlined Sales and Use Tax Agreement now counts 24 member states that have standardized definitions and administration, but the largest sales tax states, including California, Texas, New York, and Florida, are not among them, so multi-state complexity remains the operating reality for national enterprises. A program has to be built for that reality rather than wait for it to simplify. The full blueprint, including roles, cadences, and documentation standards, is in our guide to building an internal sales tax compliance program.
Warning signs your sales tax system needs attention
The clearest signs that a sales tax system is holding unclaimed refunds include vendor-charged tax appearing on exempt categories, use tax accruals that never move with business activity, exemption certificates tracked in spreadsheets, an ERP conversion that went live without a tax logic review, and a past audit whose findings surprised your team.
None of these proves an error exists. Each one indicates that the conditions for error are present and that no control would currently catch it. A tax leader does not need certainty to justify a closer look; the asymmetry does the justifying, since a review that confirms the system is clean costs little, while drift left alone compounds through every filing period and ages past the refund statute. We break down the full list, and what each sign typically means, in 7 signs your company has unclaimed sales tax refunds.
When to bring in independent validation
Bring in independent validation when transaction volume, vendor count, or project complexity exceeds what your team can review alongside daily responsibilities, when a state audit is approaching or has just concluded, or when leadership wants assurance the system works. Independent review complements internal teams; separating execution from review strengthens the findings.
The case for independence is practical, not political. Your internal team built the system and runs it every day, which makes them essential to any review and also makes a second set of eyes valuable, because incumbents tend to re-verify their own assumptions. The food manufacturer discussed above had a capable tax function and existing advisors; the $34 million sat in the gap between what everyone was already checking. A concluded state audit is a particularly good trigger, since the state has just handed you a map of where it found underpayments but has told you nothing about the overpayments sitting in the same records.
Revenew’s sales and use tax recovery services are built for exactly this seam: a team of state and local tax specialists, several of whom began their careers on the government side of the audit table, working alongside internal tax and audit leaders to validate classifications, test vendor tax application, and file the refund claims that result. The engagement model is deliberately low-friction, because validation should not require disruption to prove its value.
About the author: Richard Van Komen, VP, Sales Tax Recovery. Richard has spent more than 25 years in state and local tax and began his career as a tax auditor for the Utah State Tax Commission, experience that shapes how he approaches both sides of the audit table.
If you want to know what a structured validation would surface in your organization, the review is a no-risk engagement with zero upfront cost. Request a No-Risk Review to start the conversation with Revenew’s Sales & Use Tax Recovery team.