What is an audit?

An audit is an independent examination of your financial records, statements or tax returns to confirm they are accurate and complete. In South Africa, when small business owners think about audits, they're usually referring to a SARS tax audit conducted by the South African Revenue Service.

However, an audit can also mean a statutory financial-statement audit required under the Companies Act 71 of 2008. While a tax audit focuses on whether you've correctly reported your income and deductions to SARS, a statutory audit examines whether your company's annual financial statements give a true and fair view of its financial position. If you're new to managing your finances, getting a handle on small business bookkeeping is a good place to start.

Verification vs audit: what's the difference?

SARS uses two distinct processes when checking whether taxpayers have reported correctly: verification and audit. Understanding the difference helps you know what to expect if you receive a notice.

A verification is a face-value check of your declared information against supporting documentation or third-party data, such as information from your employer, bank or medical scheme. Verifications are normally concluded within 21 business days of SARS receiving all required material, and they tend to focus on specific items like a single claim or deduction.

An audit, in contrast, is a deeper, more thorough examination of your tax affairs. It can look at multiple tax periods and types, and may take anywhere from 30 business days to 12 months depending on complexity. If SARS selects you for an audit, you'll receive a formal notification letter and be assigned a dedicated auditor.

Types of audits

Not all audits are the same. Depending on who conducts them and what they examine, audits fall into several categories:

Tax audit: conducted by SARS to verify your tax returns and supporting records. This includes desk audits (a limited review conducted remotely) and field audits (conducted at your business premises for a more comprehensive examination).
External or statutory audit: an independent examination of your company's financial statements by an IRBA-registered auditor, required under the Companies Act for certain companies.
Internal audit: a review conducted by staff or a hired firm to assess your internal controls, risk management and operations.
Compliance audit: an examination to confirm your business meets specific legal, regulatory or industry requirements, such as B-BBEE verification or sector-specific regulations.

What triggers a SARS audit?

SARS uses risk-profiling systems and third-party data to identify taxpayers for audit. While selection can sometimes appear random, certain factors increase your likelihood of being audited:

Inconsistent VAT, PAYE or income-tax reporting across periods or compared to industry norms
Frequent VAT refund claims, especially large or unusual ones
Unusually large or unusual expense deductions that don't match your business profile
Late or amended returns, particularly repeat amendments
Third-party data mismatches (when information from employers, banks or medical schemes doesn't align with your declarations)
Operating in high-risk industries or engaging in complex, unusual transactions
A mismatch between your declared income and your lifestyle (known as a lifestyle audit)

The SARS audit process

If SARS selects your business for an audit, the process follows a structured sequence. Knowing what comes next makes it easier to respond effectively and meet your deadlines.

1. Notification of audit

SARS sends you a formal notification letter confirming that an audit has been opened. The letter explains the scope and allocates your case to a specific auditor who will be your point of contact.

2. Information requests

The auditor issues requests for supporting documents, such as invoices, bank statements, contracts and accounting records. You must respond by the deadline set out in the letter, which is typically 21 business days. Failing to respond, or providing incomplete information, can lead to delays or an adverse assessment based on the information SARS has.

3. Progress and review

SARS is required to give you progress reports every 90 calendar days while the audit is ongoing. The audit should aim for finalisation within 90 business days of receiving all your requested documents, though complex cases can take longer.

4. Outcome

Once the review is complete, SARS issues one of two letters. A Finalisation of Audit Letter means no adjustments are required. An Audit Findings Letter sets out SARS's proposed adjustments and gives you at least 21 business days to respond before the assessment is finalised.

How far back can SARS audit?

The Tax Administration Act sets out how far back SARS can reopen your tax affairs, depending on the type of tax and whether there's any wrongdoing involved:

3 years: income-tax assessments generally prescribe three years from the date of assessment
5 years: self-assessed taxes such as VAT prescribe after five years
No time limit: where fraud, misrepresentation or non-disclosure of material facts is involved, SARS can go back indefinitely

The Tax Administration Act requires you to keep records for five years from the date you submit a return, and longer if an audit or dispute is under way. The Companies Act separately requires many company records to be kept for about seven years, so don't confuse the two obligations.

Does your company need a statutory audit?

Not every company needs a full statutory audit. The Companies Act 71 of 2008 uses the Public Interest Score (PIS) to determine what level of assurance your company requires. The PIS is calculated annually based on factors like the number of employees, third-party liabilities, turnover and shareholders.

Your company generally needs an audit when:

The PIS is 350 or more
The PIS is between 100 and 349 and the financial statements are compiled internally (rather than by an independent accounting professional)
The company holds more than R5 million in a fiduciary capacity for unrelated parties
It's a public company or state-owned company
The Memorandum of Incorporation specifically requires it

Many smaller companies fall below these thresholds and need only an independent review (a lighter form of assurance), while owner-managed companies with a low PIS may need neither an audit nor an independent review. If your company does need a statutory audit, it must be performed by a registered auditor regulated by IRBA (the Independent Regulatory Board for Auditors).

Your rights during a SARS audit

The Tax Administration Act gives you specific rights during an audit. Being aware of these protections helps ensure fair treatment and proper process:

Right to be kept informed: SARS must provide progress reports every 90 calendar days and must issue an Audit Findings Letter with at least 21 business days for you to respond before finalising any adverse assessment
Right to representation: you may appoint a registered tax practitioner to represent you and communicate with SARS on your behalf
Right to request reasons: you can ask SARS to explain the basis for any assessment issued
Right to object and appeal: if you disagree with an assessment, you have formal dispute channels available

If SARS issues an assessment you believe is incorrect, you can lodge a Notice of Objection within 80 business days of the assessment date. If SARS disallows your objection, you have 30 business days to file a Notice of Appeal. Before going to the Tax Board or Tax Court, you can request Alternative Dispute Resolution (ADR) to try to settle the matter.

What happens after a SARS audit?

The outcome of a SARS audit depends on what the auditor finds. If everything checks out, you'll receive a Finalisation of Audit Letter confirming no changes are needed.

If SARS identifies discrepancies, it will issue a revised, additional or estimated (jeopardy) assessment to correct your tax liability. SARS can impose understatement penalties on a sliding scale from 0% to 200% of the shortfall, depending on factors like whether the error was a reasonable mistake or intentional tax evasion. Interest also accrues on unpaid amounts. In serious cases involving fraud, non-compliance can carry criminal liability.

If you can't pay the full amount immediately, you can request a payment arrangement with SARS. You can also apply for suspension of payment while a dispute is unresolved, provided you meet the requirements. If you've made errors or omissions you haven't yet disclosed, the Voluntary Disclosure Programme (VDP) lets taxpayers regularise their affairs before an audit, often with reduced penalties.

Why audits matter

While audits can feel stressful, they serve important purposes for your business and the broader economy:

Compliance: audits confirm that your business meets its tax obligations, reducing the risk of penalties and legal consequences
Credibility: audited financial statements give lenders, investors and business partners confidence in your numbers
Better decision-making: an audit can highlight weaknesses in your record-keeping or internal controls, giving you the information to improve
Error detection: audits catch mistakes before they compound, whether it's a misclassified expense or an overlooked deduction

Using financial reports to track your position throughout the year makes audit preparation far simpler.

How to prepare for an audit

Being audit-ready isn't about waiting for a SARS letter. It's about building good habits throughout the year so you can respond quickly and confidently if selected.

1. Keep thorough records

Maintain complete records of all income, expenses, invoices, receipts and bank statements. The Tax Administration Act requires you to keep these for at least five years from submission. Store them securely and make sure they're easy to retrieve. Understanding how to record accounting transactions properly helps you avoid gaps.

2. Reconcile your accounts regularly

Monthly bank reconciliation catches errors early and ensures your books match your bank statements. This is one of the simplest ways to keep your records accurate and audit-ready.

3. Separate business and personal finances

Use a dedicated business bank account and avoid mixing personal expenses with business transactions. This makes it much easier to substantiate your deductions if SARS asks for proof.

4. Document your deductions

Every deduction you claim should have supporting evidence. Keep invoices, contracts and receipts organised by tax period so you can produce them quickly during an audit.

5. Use cloud accounting software

Cloud accounting software keeps your records organised, backed up and accessible. It simplifies reconciliation, generates reports and makes it easier to share information with your accountant or SARS.

6. Respond to SARS promptly

If SARS requests information, you usually have 21 business days to respond, as set out in the letter. Missing deadlines can lead to adverse assessments or penalties, so treat any correspondence from SARS as urgent.

7. Get professional help

A registered tax practitioner or accountant can represent you during an audit, help you gather the right documents and communicate with SARS on your behalf. If you don't already have an advisor, understanding why you might need one is worth exploring before an audit arrives.

Stay audit-ready with Xero

Staying on top of your records doesn't have to be time-consuming. Xero's cloud accounting software helps you keep your finances organised, reconcile transactions daily with automated bank feeds and generate the reports you need when SARS comes calling. With everything in one place, you can respond to information requests faster and spend less time chasing paperwork. See how Xero keeps you audit-ready and get one month free.

FAQs on audits

Here are answers to common questions about audits in South Africa.

How long does a SARS audit take?

SARS aims to finalise audits within 90 business days of receiving all requested documents, but complex cases can take up to 12 months. You're entitled to progress reports every 90 calendar days.

What is the difference between a verification and an audit?

A verification is a quick, limited check that's usually concluded within 21 business days. An audit is a more thorough examination that can cover multiple tax periods and types, taking 30 business days to 12 months.

How long must I keep records for SARS?

You must keep tax records for five years from the date you submit the relevant return. If an audit, objection or dispute is in progress, you must keep records until it's fully resolved.

What penalties can SARS impose after an audit?

SARS can impose understatement penalties from 0% to 200% of the tax shortfall, depending on whether the underpayment was a reasonable mistake, negligence or deliberate evasion. Interest also applies to late payments.

Does my company legally need an audit?

It depends on your Public Interest Score. Companies with a PIS of 350 or more generally need an audit, while those with lower scores may only need an independent review or no assurance at all.

Learn more about audits

Handy resources

Advisor directory

You can search for experts in our advisor directory

Find an advisor

Xero Small Business Guides

Discover resources to help you do better business

See all our guides and articles

Financial reporting

Keep track of your performance with accounting reports

Find out more

Disclaimer

This glossary is for small business owners. The definitions are written with their requirements in mind. More detailed definitions can be found in accounting textbooks or from an accounting professional. Xero does not provide accounting, tax, business or legal advice.

Table of contents

Key takeaways