Published June 23, 2026
Exemption Certificate Management: What Auditors Actually Look For
All posts
You have thousands of exemption certificates on file. Your customers submitted them, your team stored them, and you assumed you were covered. So why did the audit letter still show up?
Because having a certificate on file and having a valid certificate on file are two different things.
States have gotten significantly more precise about what they want from exemption documentation. The certificate your customer submitted in 2019 might be expired, incomplete, tied to a lapsed permit, or simply not valid for the type of transaction it's covering. Auditors know exactly where to look, and they're looking more often.
This guide covers what triggers audit adjustments on exemption certificates, how state verification has changed, and what a proactive review of your own files should look like before an auditor does it for you.
The short answer is money. Invalid exemption certificates represent uncollected revenue at scale, and states have realized that even a small error rate across thousands of B2B transactions adds up fast.
A few things accelerated this shift.
Economic nexus expanded the documentation gap. After the 2018 South Dakota v. Wayfair decision, businesses scrambled to register in new states. Many didn't update their exemption certificate collection processes to match. That created a documentation gap that auditors are now working through.
State verification technology improved. Many states now maintain digital databases of registered exempt entities and can cross-reference your exempt sales against those records during an audit. An exemption number tied to a revoked or expired permit gets flagged immediately. Pattern recognition tools help auditors identify high volumes of exempt sales, unusual exemption types, or discrepancies between reported sales and industry norms.
Remote selling and new transaction types changed the rules. Drop shipping, marketplace sales, and digital commerce introduced transaction structures that existing certificates often don't cover. States updated their rules, but many businesses haven't updated their documentation.
States aren't just checking whether you have a certificate on file. They're verifying that it's current, properly completed, applicable to the specific transaction, valid for the state where the sale occurred, and supported by the customer's actual exempt status. If any of those elements are missing or questionable, you're looking at an audit adjustment.
Expired or stale certificates. Expiration rules vary significantly by state and certificate type, so there's no single rule that applies everywhere. But the pattern is consistent: businesses collect certificates at the start of a customer relationship and never revisit them. Some states have hard expiration dates. Others have recommended renewal intervals that, while not strictly mandatory, leave old certificates vulnerable during an audit. A few examples of how this plays out in practice:
Florida's standard Annual Resale Certificate expires every December 31 and must be renewed annually. Florida's Consumer's Certificate of Exemption (for nonprofits, government entities, etc.) expires every five years. Texas resale certificates don't carry a fixed expiration date — they remain valid as long as the buyer's information is current and their permit is active — but the underlying seller's permit can lapse, which invalidates the certificate. Illinois recommends certificates of resale be updated at least every three years; this is guidance rather than a hard statutory deadline, but auditors treat stale certificates as a risk factor. New York resale certificates don't expire on their own, but they become invalid if the buyer's Certificate of Authority lapses, which requires renewal at the state's discretion, typically every three years.
The takeaway isn't to memorize every state's rules. It's to have a system that tracks what you have on file, when things were last updated, and which customers are operating in states where renewal matters.
Incomplete or unsigned certificates. A certificate with blank fields is almost as bad as no certificate at all. Auditors look for complete customer name and address, a valid exemption number or clearly stated reason for exemption, a proper signature, a description of the products or services being purchased exempt, and the date it was executed. Blanket certificates — where a customer provides one document to cover all future purchases — are valid in many states, but they still need to be fully completed and clearly indicate they're intended for ongoing use.
Wrong certificate type for the transaction. A resale certificate doesn't cover manufacturing equipment purchases. An agricultural exemption doesn't apply to office supplies. A nonprofit exemption might not cover every category of goods. Auditors regularly find businesses that accepted a valid certificate but applied it to transactions it wasn't designed to cover. This happens most often when customers have multiple exemption types, when product lines have changed over time, or when new transaction types were added without updating documentation.
Certificates that don't match the selling state. A certificate issued by a customer in State A doesn't protect you on sales delivered to State B. This is especially common with drop shipping, multi-location customers, and marketplace sales where the delivery destination varies. You need a certificate valid for the state where the sale occurs — typically wherever the goods are delivered.
Customers whose exempt status has changed. Sometimes the certificate is perfectly completed and current. But the customer's resale permit has been revoked, or their nonprofit status has lapsed. States can verify exemption numbers against their own records. If the status doesn't check out, the certificate won't protect you.
Step 1: Build a complete inventory. Start by listing every exemption certificate you have on file. For each one, document the customer name and account number, the state or states covered, the type of exemption claimed, the date it was executed, any expiration date, and whether it's a blanket or single-purchase certificate. This exercise often surfaces gaps no one knew existed.
Step 2: Flag expired and aging certificates. Using your inventory, identify any certificates that have already expired under state-specific rules, any that will expire within the next 12 months, and any that haven't been updated in several years regardless of formal expiration rules. These are your highest-priority items for renewal outreach.
Step 3: Review for completeness. Pull a sample of certificates, focusing on your highest-volume exempt customers and states where you have significant exposure. Check each one for all required fields, a valid signature, a clearly stated exemption reason, and a product or service description that matches what you actually sell to that customer.
Step 4: Verify the certificate type matches the transaction. For each certificate you sample, compare the exemption type against the actual transactions you processed for that customer. Does the resale certificate cover everything you sold exempt? If the customer claims a manufacturing exemption, are all exempt purchases actually going into manufacturing? If they have multiple locations, do you have certificates for each relevant state?
Step 5: Validate exemption numbers for high-volume customers. Many states offer online lookup tools where you can confirm that a resale permit or exemption number is currently active. This step takes more time but provides the strongest protection against audit adjustments.
Step 6: Document your process. Whatever you find, write it down. Record when you conducted the review, what you sampled, what issues you found, and what you did to fix them. This documentation shows auditors you're actively managing compliance, which matters.
These two transaction types deserve special attention because they create exemption certificate challenges that standard processes often miss.
Drop shipping. When your customer orders from you and you direct your supplier to ship directly to them, you have three parties and two transactions — and multiple states with questions about who owes what. In a typical drop shipping arrangement, you need to provide your supplier with documentation showing that the sale to your end customer is exempt or that you'll handle the tax obligations. You also need to collect proper documentation from your end customer if they're claiming an exemption.
Most states accept a drop shipment exemption certificate that the retailer provides to the supplier, essentially confirming you have nexus in the destination state and will handle the tax. But the specifics vary — some states require their own certificate form, others accept a standard resale certificate with additional documentation. The safest approach is to maintain separate documentation for drop shipping transactions, including the certificate you provide to your supplier, the certificate you collect from your end customer when applicable, and records showing you collected tax or have valid exemption documentation for each transaction.
Marketplace sales. In most states, marketplace facilitators are now responsible for collecting and remitting sales tax on behalf of their sellers. This means platforms like Amazon handle the tax calculation and collection for transactions through their platform. But when a customer is exempt, someone still needs to collect and validate that exemption certificate. Most major marketplaces have their own exemption programs — Amazon Business, for example, handles this directly with qualifying buyers.
The audit risk is that you may not have visibility into which of your marketplace sales were processed as exempt, and auditors may ask about those transactions. Maintain records of which marketplaces you sell through, what exemption certificate programs they offer, and any direct communications with exempt customers who also buy through marketplace channels.
Fixing your current certificate files matters. So does building processes that prevent the same gaps from reappearing.
Centralize everything. If certificates are scattered across file cabinets, email folders, and individual drives, you can't manage them systematically and auditors can't review them efficiently. One system of record with consistent naming conventions and clear ownership is the foundation for everything else.
Automate expiration tracking. Manual tracking doesn't scale. As your customer base grows and you expand into more states, you need systems that flag approaching expiration dates, generate renewal requests, and report on certificate status across your book of business. Whether that's a dedicated certificate management platform, a module within your ERP, or well-maintained shared tooling, the key is that it runs without someone having to remember.
Build certificate collection into how you sell. The best time to collect an exemption certificate is before the first exempt transaction occurs — during customer onboarding, in the sales order workflow, or at B2B checkout. Making it a standard part of the process is easier than chasing certificates retroactively.
Review regularly. State rules change. Florida's annual resale certificate requirement has caught businesses off guard. Washington's ESSB 5814 expansion in late 2025 changed what services are even taxable there, which has downstream effects on what documentation you need. A quarterly review of your highest-risk states and an annual review of everything else is a reasonable baseline for most businesses.
Use this to assess where your process stands and where to focus first.
Certificate inventory
Currency and validity
Completeness
State-specific compliance
Transaction matching
Verification
Ongoing management
Managing exemption certificates across multiple states is complex. A few signs it may be time to bring in outside support: you're operating in more than ten states and struggling to track varying requirements, you've received an audit notice that includes exemption certificate questions, you're expanding into drop shipping or marketplace sales and aren't confident in your documentation, or you've found significant gaps in your files and aren't sure where to start.
A sales tax consultant can assess your current processes, identify your highest-risk areas, help develop compliant documentation procedures, and respond to audit inquiries. The goal is targeted support that builds lasting habits, not permanent outsourcing.
If you want to figure out where you stand before an auditor does, a free What's Next consultation with one of our sales tax experts is a good place to start. We'll look at your situation, answer your questions, and tell you exactly what needs to happen.
Schedule your free What's Next consultation with The Sales Tax People.
SALT stands for State and Local Tax. In a business context, it refers to the full range of tax obligations a company has at the state and local level — including sales and use tax, income and franchise tax, payroll tax, property tax, and any industry-specific levies. For multistate businesses, SALT is not a single obligation but a patchwork of requirements that varies by state, by tax type, and by the nature of the business activity occurring in each jurisdiction. While the term is also used in the context of the federal SALT deduction for individuals, in corporate finance and tax planning, SALT typically refers to the operational compliance and strategic risk management challenge of managing these obligations across multiple states simultaneously.
Sales tax has moved from a back-office function to a CFO-level priority for three compounding reasons. First, the 2018 Wayfair decision established economic nexus, meaning businesses now owe sales tax in states where they have significant sales volume — regardless of physical presence — creating multistate obligations that scale with revenue growth. Second, the explosion of digital goods, SaaS, and remote services has created widespread product taxability uncertainty, as states are actively and inconsistently expanding what they tax. Third, enforcement is intensifying — states are using AI-driven data matching to identify non-filers, audit frequencies are increasing, and personal liability for business owners and officers is real. The result is that SALT exposure can now materially affect a company's effective tax rate, cash flow, and audit risk — all of which are squarely in the CFO's domain.
The CFO's role in sales tax compliance has evolved from periodic oversight to active strategic ownership. In 2026, a CFO's SALT responsibilities typically include ensuring the business has a clear picture of its nexus footprint across all states, approving the selection and oversight of any sales tax automation platform or managed service provider, building SALT risk assessment into new market entry and product launch decisions, reviewing the company's exposure position at least annually and after any material business change, and ensuring the finance team has the resources and processes to stay current with the pace of state law changes. The CFO is also typically the executive accountable when a state audit notice arrives — which makes proactive SALT governance not just a compliance function but a core risk management responsibility.
Economic nexus means that every time your business crosses a state's revenue or transaction threshold — typically $100,000 in annual sales — a new set of registration, collection, and filing obligations is triggered in that state, automatically, whether or not anyone in your organization notices. For CFOs, this creates a direct connection between revenue growth and tax compliance burden: the faster the business grows into new state markets, the faster its SALT obligations expand. A CFO who delegates nexus monitoring entirely to the accounting team without building it into the company's growth planning process risks discovering significant unregistered state obligations only when a state audit surfaces them — at which point the liability includes years of uncollected tax, plus penalties and interest. Building nexus threshold monitoring into the company's sales reporting and market expansion planning is one of the most high-leverage steps a CFO can take in 2026.
A proactive sales tax strategy is one in which a company identifies and addresses its SALT obligations before a state tax authority does — rather than reacting to audit notices, penalty assessments, or due diligence findings during a business transaction. A proactive strategy typically includes an annual nexus review that maps the company's full activity footprint against its current registrations; a product taxability matrix that is reviewed whenever the company launches new products or enters new states; an exemption certificate program with systematic collection, validation, and renewal processes; a clear decision framework for evaluating new markets that includes SALT implications alongside revenue and cost projections; and a defined relationship with either an internal SALT specialist or an external compliance partner. The companies that treat SALT proactively spend less on compliance in the long run than those that repeatedly respond to crises.
SALT complexity affects growth decisions in ways that most companies do not account for until after they have committed to a new market, product, or business model. Entering a new state creates immediate registration and filing obligations. Hiring a remote employee triggers physical nexus the day they start. Launching a new digital product or subscription service creates taxability questions that vary across every state where the company sells. Acquiring another business can inherit years of unresolved SALT exposure that directly affects deal valuation. CFOs who build SALT assessment into the front end of these decisions — before the state count grows, before the product launches, before the acquisition closes — have far more options for managing the resulting compliance obligations than those who discover the implications after the fact. In 2026, SALT is increasingly a factor in whether a growth decision is financially sound, not just whether it is operationally feasible.
The first and most important step is to read the notice carefully and identify exactly what tax type, what period, and what state is involved — and what the response deadline is, because missing that deadline can forfeit the company's right to appeal. Do not respond to the state directly or provide documentation until you have engaged a SALT professional or tax attorney who can assess the scope of the audit and advise on strategy. Gather all relevant records for the audit period — sales data, filed returns, exemption certificates, nexus documentation, and any prior correspondence with that state. Determine whether the audit was triggered by a specific data match or is a routine industry audit, as the trigger often signals where the auditor will focus. And assess whether the same issue the state is auditing might exist in other states — because resolving one state's audit without addressing related exposure elsewhere is a common and costly mistake. Speed, organization, and expert representation are the three factors that most determine the outcome.
We care about your data – privacy policy
