Received a SARS Audit Letter? First Steps Before You Reply

Key takeaways

First confirm that the letter is genuine

Do not authenticate a message by clicking its own link, calling a number printed only in the message or replying with login details. SARS currently warns about fake “Notification of Audit” correspondence and states that it will not ask for passwords, one-time pins, banking PINs or eFiling login credentials through email, SMS, social media or telephone.

Use a clean browser or the official application to sign in to eFiling. Search SARS Correspondence and compare:

• the taxpayer name and reference number;
• the tax type and periods;
• the correspondence date and letter type;
• the case, audit or reference number;
• the named SARS official and official contact details; and
• the requested submission channel and deadline.

Save the eFiling copy, notification email or SMS, envelope if posted, and system metadata that shows when it was received. If the letter cannot be found or the sender remains doubtful, use SARS's published contact or phishing-reporting channels. Do not send a tax file while authenticity is unresolved.

Decide whether it is an audit, verification or another notice

SARS describes verification as a check of information in a declaration or return against third-party data and supporting records. An audit is a more extensive examination of financial statements, accounting records and supporting documents to test the declared tax position or compliance where no return was filed.

The label matters. SARS says that referral for audit does not mean the audit has started; it officially begins when SARS issues a Notification of Audit allocated to a specific auditor. That notice should state the initial scope. A verification letter instead provides its own due date and may ask for supporting documents or a Request for Correction.

In Forge Packaging (Pty) Ltd v CSARS, the High Court treated verification and audit as distinct processes and held that the section 42 audit-report framework does not simply apply to a verification. Do not use audit rights, verification turnaround targets, findings steps or dispute deadlines interchangeably.

Also distinguish the audit notice from:

• a general request for relevant material;
• an audit findings letter proposing adjustments;
• a notice of assessment;
• a demand for payment;
• an objection or appeal decision; or
• a notice connected to a criminal investigation, interview, search or seizure.

If more than one item arrived, place them in date order and identify which one creates the current response obligation.

Capture the scope, delivery date and deadline exactly

Create a control sheet from the actual letter. Record:

Use the deadline in the authenticated correspondence. Do not assume a standard number of days from an online article. If the scope is unclear, requested records are held by a third party, the volume is material or a key decision-maker is unavailable, ask the named official for written clarification or an extension before the due date. Explain the specific reason, what is already available, the work still required and a realistic proposed date. Do not assume that asking suspends the existing deadline; obtain the response in writing.

Freeze the records before analysis begins

Preserve the return or declaration as filed, every calculation and schedule behind it, the source ledgers and documents, and correspondence with the preparer. Export data in a way that retains the original system and period. Do not overwrite the filed workpaper with a revised version.

Depending on scope, the record may include:

• submitted returns, assessments and SARS correspondence;
• trial balances, general ledgers and journal entries;
• invoices, contracts, purchase orders and delivery records;
• bank statements, payment confirmations and reconciliations;
• payroll, employee, PAYE and employment-tax records;
• VAT output, input, import, export and adjustment records;
• asset registers, allowances and disposal calculations;
• related-party, loan, management-fee and transfer-pricing records;
• third-party certificates and data reported to SARS; and
• board, management or adviser records directly relevant to the tax position.

Suspend routine deletion for the relevant custodians and systems. Preserve original file names, dates, formats and audit trails. Record where every item came from, who extracted it and whether it is complete. Never backdate, recreate or alter a record without clearly labelling the later reconstruction and its source.

Put one accountable team around the response

Name a response owner and a final sign-off authority. For a business, include the public officer or registered representative, the people responsible for the return, the finance or payroll system owner, and the person who controls eFiling access. Record the limits of each person's knowledge.

Use an adviser where the tax treatment, amount, period, structure or procedural risk justifies it. SARS says that a person providing relevant paid tax services must be registered with SARS and a recognised controlling body, subject to statutory exceptions. Confirm registration through the official SARS lookup. A lawyer may be needed where legal professional privilege, suspected offences, search powers, personal liability, judicial review or litigation strategy is involved.

Do not assume that communications with every accountant, consultant or tax practitioner are legally privileged. Privilege is fact- and relationship-specific. If responsive material may contain legal advice, mark it for a separate lawyer-led review before production. Do not waive a possible protection through an unplanned attachment, and do not use privilege as a blanket label for ordinary accounting records or facts.

Convert the request into an item-by-item response matrix

Copy each numbered request into a working matrix without changing its meaning. Add columns for the stated scope, record owner, source system, responsive date range, proposed document, reconciliation status, privilege or privacy review, missing item, explanation and final file name.

For every item, decide whether it is:

• available and directly responsive;
• available but requiring an explanation or reconciliation;
• partly available, with a documented gap;
• held by a named third party and already requested;
• outside the stated period or scope, requiring clarification; or
• potentially privileged or legally sensitive, requiring separate review.

Do not answer a narrow request with an unexplained data dump. Equally, do not withhold an unfavourable responsive record because it conflicts with the return. Explain the conflict accurately and obtain advice on its legal consequence. If a request appears ambiguous or overly broad, identify the exact uncertainty and seek clarification rather than ignoring it.

Reconcile the evidence to the filed tax position

The response should allow a reviewer to trace the filed amount to its source. Build a bridge from the return line to the ledger, schedule and supporting document. For example:

1. identify the declared amount;
2. identify the ledger accounts or source population;
3. show additions, exclusions and tax adjustments;
4. reconcile the result to the submitted return;
5. explain each material variance; and
6. attach the records in the same sequence as the calculation.

Test totals, tax periods, entity names, invoice dates, VAT numbers, currency, duplicated entries and reversals. Compare the response with third-party certificates and previous SARS submissions. A factual narrative should say who did what, when, under which agreement and how the tax result was calculated. Avoid speculation about motives or copying an earlier explanation that does not match the current records.

Do not file a corrected return merely to make the audit disappear. A correction can affect admissions, periods, penalties, interest and the procedural route. First identify the error, cause, tax effect and available statutory process, then obtain suitable advice. SARS's verification guidance may invite a Request for Correction in that process; that does not make it the correct answer to every audit issue.

Protect confidential and personal information without obstructing the audit

Tax records can contain employee, customer, supplier, medical, banking and commercially sensitive information. Use the authenticated channel and restrict internal access to the response team. Redact irrelevant passwords, security credentials and unrelated account details, but do not conceal information that is responsive and lawfully required.

Keep a redaction log stating the file, page, field and reason. If the request covers third-party personal information or a large data extract, ask the auditor about secure format and transfer rather than sending it through ordinary email. Confidentiality or POPIA does not automatically defeat SARS's statutory information powers; relevance, authority, security and any privilege claim require careful analysis.

Build one indexed submission and retain proof

Use a short covering letter that identifies the taxpayer, audit reference, tax types, periods, letter date and submission date. Answer the request in its original numbered order. For each number, identify the attached file, provide a concise explanation, or state the documented reason an item is unavailable and what was done to obtain it.

Use stable file names such as 01-request-item-bank-reconciliation-period.pdf. Paginate longer documents and include a file index with description, source and date range. Check that scans are legible, spreadsheets open correctly, formulas or values are supplied as requested, and password protection has been agreed with the auditor.

SARS's current audit page says that eFiling users should upload all requested material and click “submit”; once submitted, the link closes. Check the live channel's permitted formats, file count and size before relying on a last-minute upload. Save the final bundle, portal screen, submission confirmation, case number, timestamp and any email acknowledgment. The sent set—not the draft folder—is the audit record.

Treat a proposed field audit as a separate operational event

SARS may arrange a field audit and says the auditor will produce an Authorisation Letter. Before access occurs, confirm the official's identity and authority, the premises, date, duration, scope, people required, systems or records requested, workspace, copying method and information-security controls.

Brief staff to direct the SARS team to the designated response lead. They should cooperate lawfully without guessing, volunteering unrelated opinions or deleting records. Keep a contemporaneous log of attendees, times, questions, answers, records viewed, copies taken and follow-up requests. Obtain immediate legal advice if the matter changes into an interview about suspected offences, criminal investigation, search, seizure or preservation action.

Monitor the audit after the first response

Track every further request and maintain the same matrix. Section 42 requires notice of commencement and stage reports for audits, subject to statutory exceptions. Government Notice 788, discussed in Forge Packaging, provides for a progress report within 90 days after the audit starts and at 90-day intervals until completion; the report describes current scope, completion stage and outstanding relevant material. SARS's current public page expresses this as every 90 calendar days from the Notification of Audit.

That reporting cycle is not a promise that every audit will finish in 90 days. SARS says audit duration can vary substantially with complexity, transaction volume and cooperation. Escalate a missing report through the appropriate SARS channel with the audit reference and chronology; do not stop responding merely because a progress report is late.

At the end of an audit, distinguish a finalisation letter from an Audit Findings Letter. Where material adjustments are proposed, the findings should set out the grounds and the taxpayer generally receives at least 21 business days to respond, subject to the statutory complexity and prejudice provisions. A response to findings is still part of the audit; it is not yet an objection to an assessment.

If SARS later issues an assessment, record its delivery, grounds, amount and payment date separately. The SARS objection document pack and tax-dispute checklist organise the later dispute file; they do not replace the first audit response. The Tax Compliance Status glossary explains that separate status concept.

Where private advice is required, define the task: authenticate and classify the notice, review scope, manage an extension, test the tax position, protect privilege, reconcile documents, respond to findings or prepare for a field audit. The Lexuno lawyer directory is a discovery route, not proof of tax-practitioner registration, audit experience, availability or outcome.

FAQs

Related Lexuno paths