How Does a CDTFA Audit Work? A Step-by-Step Guide for California Businesses
Author
John Milikowsky, Esq. | Founder | John Milikowsky represents U.S. and foreign businesses and individuals in sophisticated business transactions involving U.S. tax matters. Relentlessly defending each client in federal and state audits and criminal investigations to protect their civil rights and provide financial security.
A CDTFA audit doesn’t announce itself dramatically. It arrives as a letter, a notice that a review of your sales tax returns has been scheduled, along with a date and a list of records to gather. For most business owners, that letter raises more questions than it answers.
How long does this take? What are they looking for? What happens if they find something?
The process has a defined structure, and understanding each stage makes it considerably easier to navigate. What follows is a breakdown of how a CDTFA audit typically unfolds, from the first notice through final resolution.
What Is the CDTFA and What Does It Audit?
The California Department of Tax and Fee Administration administers sales and use tax in California, along with excise taxes on fuel, tobacco, alcohol, and cannabis. When businesses sell taxable goods or services in California, they’re required to collect sales tax from customers and remit it to the state.
CDTFA audits are initiated to verify that what a business reported on its sales tax returns matches what actually happened in its books. The agency compares your reported taxable sales against your bank records, merchant account activity, income tax filings, and general ledger. When those numbers don’t align, the auditor draws conclusions about the difference.
Industries that show up most frequently in CDTFA audits include retail, restaurants and food service, construction, automotive, cannabis, and any business with a significant volume of cash sales or exempt transactions. The common thread isn’t the industry itself, it’s the documentation complexity. Businesses with high transaction volume, mixed taxable and non-taxable sales, or inconsistent record-keeping across locations tend to attract more scrutiny.
Step 1: The CDTFA Audit Notice
The audit begins when CDTFA sends a Notice of Audit Commencement. This letter identifies the audit period, usually the prior three fiscal years, and typically requests an initial meeting with the auditor along with an opening document request.
The period can extend beyond three years in cases where returns were not filed or where the agency has reason to believe fraud or substantial underreporting occurred. In those situations, the lookback window can reach eight years. Most routine audits stay within the standard three-year window.
One issue that comes up frequently is businesses treating this initial letter as a deadline they need to race to meet. The more useful approach is to treat it as the beginning of a process that requires preparation. The auditor is going to build a picture of your business based on what you provide. Getting organized before that picture starts forming is worth the time.
Step 2: The Opening Meeting
Shortly after the notice, the auditor will schedule an opening meeting. This is a face-to-face or virtual conversation where they walk through how your business operates: your sales process, your point-of-sale systems, how you track exempt sales, and how your financial records are organized.
This meeting shapes the auditor’s understanding of your business before they’ve seen a single document. The way you explain your operations, clearly, accurately, and in a way that matches what your records will show, sets the tone for everything that follows.
A common mistake at this stage is over-explaining or volunteering information beyond what’s asked. The auditor’s role is to verify your reported sales. Your role is to explain your business clearly enough that they can do that accurately. Those are different things.
We often see businesses come into the opening meeting unprepared for the questions an auditor asks about exempt sales, intercompany transfers, and non-taxable revenue. Those topics come up early and they matter. Knowing how to address them before the meeting is worth the preparation.
Step 3: Document Request and Records Review
Following the opening meeting, the auditor issues a formal Information Document Request (IDR). This outlines the specific records they need for the audit period.
The standard records in a CDTFA audit include:
- Sales tax returns for the audit period
- General ledger and chart of accounts
- Bank statements for all business accounts
- Federal and California income tax returns
- Merchant account and point-of-sale reports
- Exemption and resale certificates for claimed exempt sales
- Purchase records and accounts payable documentation
The auditor will compare these sources against each other. The total deposits across your bank accounts, for example, will be used as a reference point for your reported gross sales. Differences between what your bank records show and what your sales tax returns reflect will become the basis for questions and, potentially, adjustments.
Providing only what was requested matters here. Excess documentation that doesn’t add clarity tends to raise additional questions rather than resolve existing ones.
Step 4: How CDTFA Uses Statistical Sampling
For businesses with high transaction volume, CDTFA auditors often use statistical sampling rather than reviewing every transaction in the audit period.
Here’s how it works: the auditor selects a representative sample period, typically a few months, and reviews those transactions in detail. If they find errors in that sample, they apply the error rate across the entire audit period to estimate the total liability. A small error rate in the sample period, multiplied across three years of sales, can produce a significantly larger assessment than the actual discrepancy warrants.
This is one of the most consequential parts of a CDTFA audit and one of the least understood by business owners who go through the process without representation.
The sample period matters. If the auditor selects a period that is not representative of normal operations, a month affected by a large one-time transaction, a seasonal spike, a system conversion, or an unusual promotional event, the extrapolated result will be skewed. That error can be challenged, but only if you understand how the sample was selected and what factors made it unrepresentative.
Resale certificates are the most common source of sampling errors. When a sale is claimed as exempt for resale, the certificate supporting that exemption needs to be present, properly completed, and signed by a buyer who holds a valid California seller’s permit. Certificates that are missing, expired, or improperly executed during the sample period get reclassified as taxable, and that reclassification gets extrapolated. For businesses with significant exempt sales, the impact compounds quickly.
If your business is selected for statistical sampling, understanding how the methodology was applied and whether the sample period is truly representative is an essential part of the defense.
Step 5: The Auditor’s Preliminary Findings
Once the records review is complete, the auditor prepares a preliminary report outlining their findings. This document shows how the auditor arrived at any proposed adjustments, the calculations behind the numbers, where discrepancies were identified, and how those discrepancies were treated.
This report is worth reviewing carefully before responding. The methodology section explains whether sampling was used, which period was selected, and how the error rate was applied. The schedules show each category of discrepancy and the resulting adjustment. Errors in the methodology or miscategorized transactions can often be identified at this stage.
Businesses have an opportunity to respond to the preliminary findings before the audit moves to a formal assessment. This is a real opportunity, not a formality. Providing documentation that explains identified differences, intercompany transfers, timing adjustments, non-taxable receipts incorrectly grouped with taxable revenue, can result in meaningful reductions before any formal liability is established.
Scheduling a meeting with the auditor and their supervisor to walk through the preliminary findings is appropriate and often productive. Auditors are not adversaries. They are following a process, and that process has room for explanation and correction.
Step 6: Notice of Determination
If the audit results in an unpaid liability, CDTFA issues a Notice of Determination. This document formally states the amount owed, broken out into tax, penalty, and interest.
Penalties in a CDTFA audit typically run 10% for negligence or disregard of the law. Cases where the agency determines the underreporting was intentional can draw higher penalty rates. Interest accrues on the unpaid tax from the original due date.
The Notice of Determination also establishes a deadline. You have 30 days from the date of the notice to file a petition for redetermination if you disagree with the findings. Missing that window finalizes the assessment. Once it becomes final, the balance is turned over to collections and the tools available to challenge it become significantly more limited.
Step 7: Petition for Redetermination (Appeal)
Filing a petition within the 30-day window keeps the matter open and moves it into the formal appeal process. The petition should explain, specifically and with supporting documentation, where the auditor’s findings are incorrect and why.
A well-organized petition does not just assert disagreement, it presents the facts clearly enough that the reviewer can follow the reasoning without having to reconstruct the analysis themselves. Supporting documents should be labeled, organized, and referenced specifically in the petition narrative.
After the petition is filed, CDTFA reviews the submission and responds. In some cases, adjustments are made based on the petition. In others, the matter proceeds to a hearing before the Office of Tax Appeals (OTA), which operates independently from CDTFA and reviews the case on its merits.
The OTA process adds additional time to the resolution timeline. A fully contested CDTFA case, from audit through OTA decision, can span two to four years depending on complexity and how many levels of review are pursued.
How Representation Changes the CDTFA Audit Process
Most business owners who go through a CDTFA audit without representation do not lose on the merits. They lose on process, providing documentation without explanation, missing deadlines, accepting a sampling methodology that inflated the proposed liability, or filing a petition that doesn’t adequately address the agency’s findings.
The cases where the outcome changes most significantly with professional involvement tend to involve one of three things: a sampling period that wasn’t representative of normal operations, missing or improperly documented resale certificates that get reclassified as taxable, or a preliminary report that contained a calculation error that carried through to the final assessment.
None of those issues require litigation to address. They require knowing where to look.
If you’ve received a CDTFA audit notice or are in the middle of a review, Milikowsky Tax Law represents California businesses in CDTFA audits at every stage, from the opening meeting through appeal. Contact us at (858) 450-1040 to discuss where things stand.
Frequently Asked Questions About CDTFA Audits
How long does a CDTFA audit take?
Most CDTFA audits run six to eighteen months from the opening meeting to the Notice of Determination. Cases that proceed through a petition and OTA appeal can extend the total timeline to two to four years.
How far back can CDTFA audit my business?
The standard audit period is three years. CDTFA can extend to eight years in cases involving fraud, substantial underreporting, or unfiled returns.
What triggers a CDTFA audit?
Common triggers include discrepancies between sales tax returns and income tax filings, high volumes of claimed exempt sales relative to industry norms, late or inconsistent filing history, anonymous tips, and referrals from other agency audits. Cross-agency data sharing between CDTFA, the IRS, FTB, and EDD means an audit with one agency can surface issues that prompt a review by another.
What is statistical sampling and can it be challenged?
Statistical sampling is a method CDTFA uses to estimate total liability by reviewing a sample period and extrapolating the error rate across the full audit window. It can be challenged when the selected sample period is not representative of normal operations, or when the methodology was incorrectly applied. Challenges to sampling methodology need to be raised during the audit or in the petition, not after the assessment becomes final.
Can CDTFA hold me personally liable for my business’s sales tax debt?
Yes. Under California law, individuals with financial control over a business can be held personally responsible for unremitted sales tax. This includes owners, officers, and others who had authority over the decision to pay or not pay the tax. Personal liability can survive a business closure or bankruptcy.
Do I need an attorney for a CDTFA audit?
You are not required to have representation. For smaller audits with straightforward records and no exempt sales issues, some businesses handle the process themselves. For audits involving statistical sampling, resale certificate deficiencies, assessments over $50,000, multi-location operations, or penalty findings, professional representation consistently produces better outcomes. The earlier in the process that representation is engaged, the more options are available.
Milikowsky Tax Law defends California businesses in CDTFA sales tax audits, use tax disputes, and appeals. For more on what triggers a CDTFA audit, see What Triggers a California CDTFA Sales Tax Audit? For information on our CDTFA representation, visit our CDTFA Audits & Disputes practice page.
