What Triggers a SARS Audit?

Receiving a letter from SARS makes most business owners nervous, even the ones who have done nothing wrong.

SARS does not publish a list of audit triggers. What we do know is that case selection is driven by automated risk scoring, built on your compliance history and the third-party data SARS already holds about you.

Here is what tends to draw attention, and what actually happens if you are selected.

Verification Is Not the Same as an Audit

These two words get used interchangeably. They are different processes with very different scopes.

A verification is a face-value check.

SARS compares what you declared on your return against third-party data and your supporting documents. It usually means providing documents to substantiate specific figures. Verifications are far more common than full audits.

An audit is far more extensive.

It involves examining your financial and accounting records to determine whether you declared your tax position correctly. Where no return was filed at all, it becomes an investigation into whether your conduct complied with tax law.

SARS can select any taxpayer for either process, and being verified does not protect you from being audited afterwards. In both cases SARS notifies you by official letter.

The Most Common Triggers

SARS receives data directly from employers, banks, medical aid schemes, retirement funds, investment houses, and cryptocurrency exchanges. Your return is compared against all of it automatically.

Mismatched third-party data

The single most common trigger. Interest income reported by your bank but omitted from your return. An IRP5 from a second employer that you forgot to declare. Even small discrepancies attract attention, particularly if they repeat across tax years.

Returns that do not agree with each other

If your VAT submissions, PAYE declarations, and income tax return do not reconcile with one another, the system flags it. High declared turnover paired with very low profit is a classic example.

Deductions that do not fit the business

Claims that look inconsistent with the nature of your trade invite questions. Luxury vehicle costs or extensive travel claimed by a small home-based consultancy is a common example.

Large or unusual VAT refund claims

Input VAT claims that are significantly out of line with your normal pattern will be examined to confirm they are supported by valid tax invoices.

A poor compliance history

Consistently late returns, outstanding returns, or repeatedly amending returns after submission all raise your risk score. SARS treats compliance behaviour itself as a risk indicator.

Lifestyle inconsistent with declared income

Where a taxpayer's apparent standard of living does not match what they declared, SARS may request an explanation of the source of funds.

Higher-risk categories

Provisional taxpayers are scrutinised more closely because their payments are based on estimates rather than fixed payroll data. Cash-intensive businesses and cross-border trade also carry elevated risk.

What Actually Happens If You Are Selected

You will receive an official letter from SARS setting out what has been selected and what is required.

You are given a period, stated in the letter, to respond and submit the requested supporting documents. Respond within the stated timeframe. Failure to respond can result in SARS raising an assessment based on estimates, which is very often higher than what you actually owe.

If SARS identifies discrepancies after reviewing your documents, it issues a Letter of Findings setting out its conclusions. You have the right to respond to that before a revised assessment is raised, and the right to formally object to an assessment you disagree with.

Understatement penalties under the Tax Administration Act are calculated on the tax shortfall, at a percentage set by the behaviour involved. A genuine bona fide inadvertent error attracts no penalty. Beyond that, the table starts at 25% for a lack of reasonable care and rises to 200% for intentional tax evasion in a repeat case. SARS has no discretion here. Where a behaviour category applies, the penalty is mandatory, which is why many taxpayers are penalised for errors they considered minor or technical.

How to Reduce Your Risk

You cannot make yourself audit-proof. Selection can happen to any taxpayer. What you can do is make sure that if it happens, it is quick and uneventful.

Declare everything, including the small amounts.

Interest income, a side income stream, a second IRP5. If a third party reported it to SARS, it needs to be on your return.

Check your auto-assessment before accepting it.

Pre-populated does not mean complete or correct.

File on time, every time.

Compliance history is itself a risk factor. Late and outstanding returns raise your score independently of whether your figures are accurate.

Keep your supporting documents.

Five years from the date you submitted the return, seven for companies. If you cannot substantiate a deduction, SARS can disallow it regardless of whether it was legitimate.

Make sure your returns reconcile.

Your VAT, PAYE, and income tax submissions should tell the same story about your business.

Respond promptly when SARS contacts you.

Most verifications are resolved without escalation when the requested documents are provided on time.

An audit is not an accusation. SARS selects taxpayers through automated risk scoring, and sometimes there is no dramatic reason behind it.

What determines how the process goes is whether your records support what you declared. Businesses with clean books and complete documentation deal with verifications as routine admin. Businesses without them find it expensive.

Important: This article provides general guidance for South African taxpayers and businesses. Every situation is unique. If you have received a notification from SARS, consult a qualified accounting professional about your specific circumstances.