Quick answer
The most damaging response mistakes are usually control failures: treating every SARS letter as the same process, assuming a standard deadline, answering beyond the stated scope, sending an unindexed data dump, altering or silently reconstructing records, submitting figures that do not reconcile, making speculative admissions, claiming blanket privilege or POPIA protection, hiding evidence gaps, choosing a correction or dispute route too early, and keeping no proof of the exact submission.
How to use this guide
Review a draft through a failure-and-control register before it is released. For each risk, record the possible consequence, the corrective control, the owner and whether specialist advice is needed. This is a red-team review, not another first-response workflow. Use the audit-letter first-steps guide to authenticate and classify the notice, and use the final deadline checklist only when the response pack is substantially complete.
Mistake 1: responding to the wrong procedural stage
A request for supporting documents during verification, a referral for audit, a Notification of Audit, an Audit Findings Letter and a notice of assessment do not perform the same function. A referral notice does not itself mean an audit has begun; SARS says an audit begins when a Notification of Audit allocates it to an auditor. An Audit Findings Letter is not yet the same as an assessment that can simply be treated as an objection-stage document.
Control: identify the exact letter title, date, case reference, tax type, period, stated action, response channel and next procedural event. If the classification is uncertain, seek written clarification through an official channel. Do not “object to the audit letter” merely because the proposed position is disputed.
Mistake 2: assuming a standard deadline or that a request pauses it
Internet summaries often describe common timeframes, but the controlling date for the current response is the authentic letter and any valid written change. A request for clarification, extension, complaint or appointment does not automatically stop the running time.
Control: preserve the letter and delivery evidence, calculate an internal work-back plan from its exact due date and time, and keep written proof of any extension actually granted. Escalate before the last day if the pack cannot be completed. Do not represent a SARS operational target for completing verification or audit work as a guaranteed taxpayer deadline or remedy.
Mistake 3: altering or silently reconstructing records
Cleaning a scan, converting a file or preparing a schedule can be legitimate. Presenting a later-created record as an original is not. Risks arise when teams overwrite source files, change descriptions to make figures match, backdate documents, remove pages without a redaction record or create a replacement document with no provenance.
Control: preserve an immutable source copy. Label every converted, annotated, redacted or reconstructed version. Record who created it, when, why and from which inputs. Put unresolved authenticity or provenance issues in the exception register and obtain advice where the issue could affect credibility or exposure.
Mistake 4: sending a bulk data dump
Volume is not completeness. A folder containing hundreds of mixed records may still fail to answer the specific requests, may expose irrelevant sensitive information, and can make it impossible to show which evidence supports which figure.
Control: use a request-to-evidence matrix and a final index. Submit the relevant, reviewed record set in the same order as the requests. If a large population is necessary, include a controlled schedule that explains the population, totals, exceptions and path to the source records. The source-document organisation guide provides the detailed architecture.
Mistake 5: submitting unreconciled figures
A schedule that does not agree with the return, declaration, ledger or source documents can create more questions than it answers. Common causes include different periods, duplicate entries, reversals, VAT-inclusive versus VAT-exclusive amounts, unexplained journals and summaries that omit exceptions.
Control: build a trace from the filed position to the computation, ledger and source record. Show reconciling items rather than hiding them. Make sure explanations and schedules use the same population, period and terminology. A difference should have an owner and an approved treatment before submission.
Mistake 6: making speculative legal conclusions or unnecessary admissions
A hurried narrative may call conduct “negligent,” “fraudulent,” “non-compliant” or “an error” before the facts and law have been reviewed. It may also concede a tax treatment that the records do not support or answer a question SARS did not ask.
Control: separate verified fact, accounting treatment, tax analysis and legal conclusion. State what the records prove and identify unresolved issues accurately. Where wording could affect penalties, personal exposure, privilege, a voluntary disclosure decision or later dispute rights, obtain specialist advice before sending it. A careful response is not an invitation to be evasive; it is a control against unsupported characterisation.
Mistake 7: relying on blanket POPIA, confidentiality or privilege claims
Personal or commercially sensitive information still needs controlled handling, but a general confidentiality label does not automatically defeat a lawful SARS request. Accountant or auditor files are not all legally privileged. Using a lawyer also does not turn pre-existing facts and source records into privileged material.
Control: identify the exact information, request, relevance, third-party interests and legal basis for any proposed withholding or redaction. Segregate potentially privileged communications for legal review. Respond to the request through a reasoned, documented process rather than omitting material without explanation.
Mistake 8: hiding gaps or conflicting records
Teams sometimes leave out a missing invoice, contradictory email, duplicate payment, disputed contract or unexplained journal because they hope it will not matter. The result can be an apparently complete pack that collapses when SARS compares it with third-party data or asks a follow-up question.
Control: maintain an exception register. Record the gap, searches made, alternative evidence, impact, owner and proposed explanation. Review conflicts across the full pack so one schedule does not contradict another. Do not invent a document to close the gap.
Mistake 9: choosing an RFC, VDP, objection or complaint route prematurely
A Request for Correction during verification, a voluntary disclosure application, an objection after an assessment and a service complaint are different mechanisms. None should be used as a generic “fix SARS problem” button. An objection route belongs to an assessment or eligible decision, not merely to the fact that an audit is underway. A complaint does not suspend a response, dispute or payment deadline. Voluntary disclosure eligibility can be affected by an existing audit or investigation and requires fact-specific advice.
Control: identify the legal and procedural problem before selecting a route. Record the decision, authority and consequences. If there may be undisclosed non-compliance, serious penalties, an alleged intentional act or a possible offence, seek advice before making corrective statements or submissions.
Mistake 10: uploading without submitting or preserving proof
SARS's public verification and PAYE guidance distinguishes placing files on the work page from completing the “submit” step. A link may close after submission. Without a frozen manifest and receipt, the team may later be unable to prove what was sent.
Control: review the entire upload set, complete the final submission action, save the acknowledgement or available proof, and archive the exact files. Record the user, date, time, channel and case reference. Assign a named owner to monitor SARS correspondence for additional requests, findings or an assessment.
Build a failure-and-control register
Before release, challenge the pack with one row per possible failure:
- failure description;
- request item or document affected;
- likely factual, procedural or legal consequence;
- preventive or corrective control;
- evidence that the control operated;
- responsible owner;
- escalation trigger; and
- final status.
Do not mark a risk “closed” because someone looked at it. Closure evidence might be a written clarification, a completed reconciliation, a provenance note, a corrected index, a legal review decision or a fresh submission manifest. Any unresolved high-impact item should stop release until the authorised decision-maker accepts a defined treatment.
Use the questions-before-responding guide where the corrective control depends on an unanswered process, scope, evidence or authority decision. Where the register identifies a genuine legal-characterisation, privilege, disclosure or serious-exposure issue, obtain appropriately scoped advice before release.
FAQs
Can I object to a SARS audit letter?
Do not assume the objection process applies merely because an audit is underway. First identify the exact letter and stage. Objections generally belong to an assessment or eligible decision, while an audit response follows its own letter and process.
How should I record a mistake found before the response is released?
Log the defect, affected request item and version, assign an owner and corrective action, preserve the earlier draft, and require the replacement to pass the same factual and approval controls before release.
Can I recreate a missing source document?
Do not present a reconstruction as an original. Preserve the available source material, label any later schedule or reconstruction, record its inputs and creation date, and obtain advice if authenticity or sufficiency is material.
Is it safer to send every document I have?
Not necessarily. A bulk dump can omit the request mapping, reveal irrelevant sensitive material and create contradictions. Build a relevant, indexed and reviewed response pack.
Related Lexuno paths
Related articles
Source notes
Legal note
This article is general legal information for South African readers. It is not legal advice. Speak to a qualified legal professional about your specific facts before taking action.