Now in open beta — close the books in 2 days, not 2 weeks.Read the case study →
Business · March 5, 2026 · 11 min read

Tax audit preparation: a 30-day SMB checklist

An audit notice from your tax authority — IRS, HMRC, CRA, ATO, or the local equivalent — is not the end of the world, but unprepared SMBs make it harder than it needs to be. Most audits are won or lost in the first 30 days based on documentation quality. Here is the practical checklist, the common triggers, and the response playbook that consistently survives review.

What triggers a tax audit.

Tax authorities use a mix of risk-based selection plus random sampling. The risk factors that increase audit probability: large variance between declared income and lifestyle indicators, revenue dropping while peer industry is rising, mismatch between sales tax / VAT / GST returns and income tax returns, large input-tax claims relative to industry norms, and significant cash transactions. None of these are dispositive on their own but combinations raise the probability sharply.

Random sampling means even clean filers get notices. The right preparation is not to avoid audit; it is to be ready when one comes. Audit-readiness is a continuous practice, not a once-a-year scramble. The cost of audit-readiness is minor when built into normal bookkeeping; the cost of last-minute reconstruction is severe.

The 8-document core package.

Every tax audit will request these 8 documents within the first 7 to 14 days. Have them assembled in advance: (1) audited or reviewed financial statements for the year under review, (2) trial balance reconciled to the financials, (3) bank statements for all company accounts, (4) sales tax / VAT / GST returns and supporting input invoices, (5) income tax return with supporting calculations, (6) vendor master with tax IDs (TIN, VAT number, ABN, BN, or the local equivalent), (7) customer master with tax IDs, (8) fixed asset register with depreciation calculations.

These should be retrievable in under 30 minutes from your accounting system. If retrieval takes a week, you have an audit-readiness problem regardless of whether the underlying numbers are correct. The auditor reads slowness as evasion even when it is just disorganization.

  • Audited / reviewed financials for year under review
  • Trial balance reconciled to financials
  • Bank statements for all company accounts
  • Sales tax / VAT / GST returns + input invoices
  • Income tax return with supporting calculations
  • Vendor master with tax IDs
  • Customer master with tax IDs
  • Fixed asset register with depreciation

Common audit findings and how to avoid them.

Finding 1: input tax claimed on invoices that do not meet local requirements (missing VAT number, missing supplier registration). Avoidance: maintain tax-registration status in the vendor master, refuse to claim input where the invoice does not support it, document the choice. Finding 2: withholding tax not deducted on payments where required (US 1099, UK CIS for construction subcontractors, similar regimes elsewhere). Avoidance: automated withholding calculation at payment time, with vendor classification driving the rate. Finding 3: unreconciled differences between indirect-tax return and income tax return revenue. Avoidance: monthly reconciliation between the two during the year, not at audit time.

Finding 4: cash transactions above thresholds without proper documentation (most authorities flag aggregate cash deposits above $10,000 / £10,000 / equivalent). Avoidance: cash receipts and payments above these thresholds should be exceptional and documented. Finding 5: related-party transactions without arm's-length pricing. Avoidance: written related-party policy with market-rate benchmarks updated annually.

All audit findings · 100 %Bad input-tax invoices · 35 %Missing WHT deduction · 25 %Tax/income return mismatch · 18 %Undocumented cash · 12 %Related-party pricing · 10 %
60% of audit findings trace to two issues — input-tax discipline and WHT compliance. Fix those before worrying about exotic edge cases.

The 30-day response playbook.

Days 1-3: receive notice, log it, identify the auditor and case officer. Engage a tax advisor (CPA, chartered accountant, enrolled agent, or equivalent with current audit experience in your jurisdiction). Do not respond substantively without advisor review. Days 4-10: assemble the core 8 documents. Identify likely focus areas based on the notice language. Days 11-20: prepare detailed responses to specific queries. Anticipate follow-up questions and have answers ready. Days 21-30: submit responses on time, in full, with cover letter listing every document attached.

Late submissions are read as evasion. Incomplete submissions are read as evasion. Even if a particular item is genuinely missing, submit a partial response on time with a clear note about the missing item and a deadline by which it will follow. Silence is the worst response.

Day 1-3Engage advisorDay 4-10Assemble docsDay 11-20Draft responsesDay 21-30Submit + cover letter
Silence is the worst response. A partial reply on time beats a perfect reply submitted late.

Working with a tax advisor.

Choose a tax advisor before you need one. Cost during peace time is $3,000 to $15,000 annually for ongoing advisory plus filings (depending on jurisdiction and complexity). Cost during an active audit is $3,000 to $20,000 depending on complexity. The advisor should have current audit experience (within last 2 years) and references from similar-stage businesses.

A common mistake is engaging an advisor only after a notice arrives, which means they are learning your business under time pressure. A better arrangement: a retainer with quarterly reviews so the advisor knows your books before any notice. The retainer often pays for itself in optimization advice over 12 months even without an audit.

How clean books make audits faster.

Audits with clean books typically resolve in 60-90 days with minor adjustments. Audits with messy books drag on 6-12 months and produce significant assessments because the auditor has to make worst-case assumptions about anything unclear. The financial cost of unclean books at audit is usually 5-10x the cost of having kept clean books in the first place.

Concretely: an SMB with clean books and Nonari's audit log can show every transaction, every change, every user, every date. The auditor sees a system, not a story. With messy books, the auditor sees a story and discounts it. The audit log is the most powerful audit-defense asset most SMBs do not realize they have.

How Nonari supports audit-readiness.

Five built-in features that matter at audit time. One: complete audit log on every transaction with user, timestamp, and original-versus-changed values. Two: vendor and customer masters with tax ID and registration-status fields. Three: withholding-tax automation that calculates the right rate based on classification (1099-eligible, CIS subcontractor, etc.). Four: monthly trial balance and bank reconciliation as standard reports. Five: branch and entity P&L for cases involving multi-location operations.

None of these eliminate the need for a tax advisor or for diligent month-end discipline. They make both more effective. An advisor working with Nonari-clean books can prepare an audit response in 30 percent of the time of working with traditional unclean books, which usually translates to lower fees and better outcomes.

Frequently asked

Common questions.

How much advance notice does a tax authority give before an audit?

The initial notice typically gives 14 to 30 days for the first response (IRS Information Document Requests, HMRC enquiry letters under FA1998 Schedule 18, CRA audit letters, and ATO review notices all sit in this range). Substantive document submission deadlines run 30-60 days. Extensions are possible but should be requested in writing with specific reasons. Treat all stated deadlines as hard.

Can the tax authority access my accounting system directly?

Increasingly yes, especially with HMRC's Making Tax Digital and similar electronic-records regimes. Provide exports rather than direct system access. Ensure your audit log shows every change, because auditors compare exports across requests to detect post-notice modifications.

What if I find errors in my prior filings during audit prep?

Discuss with your tax advisor immediately. Voluntary disclosure of errors before the auditor finds them typically reduces penalty significantly (IRS voluntary disclosure, HMRC unprompted disclosure, CRA voluntary disclosures program — all give meaningful penalty relief). Hiding known errors that the auditor later finds escalates the case. Disclosure is almost always the right move.

How long should I retain records?

Varies by jurisdiction but typically 6 to 7 years (IRS general, HMRC general, CRA general, ATO general). Most prudent SMBs keep 10 years of complete records by default. Electronic retention via the accounting system is acceptable in all major jurisdictions; paper backups are no longer required for system-generated records.

Should I be present during the audit interview?

Yes, with your tax advisor. Do not let the bookkeeper handle the interview alone. The owner's presence signals seriousness and allows judgement calls. The advisor prevents off-the-cuff statements that create problems later.

Try nonari

Put your books on autopilot.

Free to start. No credit card. Bring your books, kick the tires, export everything if you decide to leave.