CDTFA sales tax audit

The CDTFA Records Request: What the Auditor Asks For, What You Have to Produce, and Where Audits Go Wrong

The records request in a California Department of Tax and Fee Administration (CDTFA) sales tax audit is the list of books and records the auditor wants for the audit period, and its deadline is the production date the auditor sets, usually the first appointment or a date agreed at the opening conference. The list is long by design: sales and purchase journals, the general ledger, federal returns, bank and card statements, point-of-sale data, resale certificates and purchase invoices. What you produce, and how, decides whether the auditor tests your records or replaces them with an estimate. For the audit itself rather than this list, start with our CDTFA audit attorney page.

Sam Brotman, J.D., LL.M.

Last updated September 2026

What the CDTFA records request is and why you received it

The records request is the auditor’s working list of what the law already requires you to keep, and you received it because a sales and use tax audit is a comparison of your returns to your records. Section 7053 of the Revenue and Taxation Code requires every seller and retailer to keep records of sales, purchases and the tax collected, and section 7054 gives the CDTFA the right to examine them. Regulation 1698 fills in the detail: the records have to show gross receipts from all sales, the deductions claimed on each return and the purchase price of everything bought for resale or for use, kept for at least four years. The list is drawn from that regulation and the CDTFA’s Audit Manual, and Publication 116, Sales and Use Tax Records, is the plain-language version.

The deadline on the records request and what happens if nothing is done

The records are due on the date the auditor sets, which is negotiable, and a business that produces nothing does not stop the audit; it hands the auditor the right to estimate. Regulation 1698.5, the CDTFA’s audit procedures regulation, calls for a reasonable time to gather records, and a representative can usually get a few weeks. A business organizing a large production gets patience, and a business that has gone quiet gets a determination. Section 6481 of the Revenue and Taxation Code lets the CDTFA compute the tax from any information it has, and under section 6091 all gross receipts are presumed taxable until you prove otherwise, so the estimate is built from bank deposits, Form 1099-K totals, federal return figures and an industry markup. The Notice of Determination (NOD) that follows usually carries the 10 percent negligence penalty under section 6484, you have 30 days under section 6561 to petition, and the burden of proving the estimate wrong is then yours.

How engagements work

Many matters like this one run as a monthly flat-fee engagement: one number, agreed up front, that covers the work — agency contact, deadlines, document responses, strategy — until the matter resolves. Shorter, well-defined projects are often a one-time flat fee instead, and some matters genuinely fit hourly billing better. We will tell you which you are looking at on the first call, before you commit to anything. If you want the details first, see how we price our work.

What is on your CDTFA records list, and what is missing?

Tell us where things stand. We respond to new inquiries within one business day.

Or book directly: free 15-minute call · (619) 378-3138

What to do in the first 30 days

The first 30 days are for reading the list against what you have, producing the audit period and nothing outside it, and settling in writing how the auditor will test what you produce. In order:

  1. Match the list to the audit period; anything requested outside those quarters is a question to raise, not a box to fill.
  2. Take inventory before you produce, noting the missing quarters for each item, and get them from the bank, the card processor and the point-of-sale vendor, which keep copies.
  3. Run the reconciliations yourself: federal gross receipts to reported sales, card deposits to taxable sales and bank deposits to recorded sales, with a written reason for every difference.
  4. Pull the resale certificates and match each to the customer and the invoices; a missing certificate, a customer without a permit, or goods the customer does not sell is an exposure to find now.
  5. Produce in an organized set by quarter, with a cover letter listing what is enclosed, and keep a copy of everything.
  6. Ask for the sampling plan in writing and review the method and the periods before agreeing to it.

Your options for the records request

There are four ways to answer a records request, and only one of them is a bad idea.

  • Produce the full list yourself. Works for a business with clean books and complete records; the risk is producing more than the list asks for.
  • Produce through a representative. The records go out under a cover letter, questions come back in writing, and anything outside the period or the list is discussed before it goes, which is how an audit stays narrow.
  • Reconstruct what is missing. Bank statements, card reports, vendor statements and point-of-sale data can be re-obtained, and a reconstruction you build beats the auditor’s estimate, because yours uses your actual purchases and prices.
  • Produce nothing. This is the bad idea; it ends in an estimate under section 6481, a negligence penalty and a petition in which you carry the burden of proof.

What Brotman Law does with a CDTFA records request

For a records request our first thirty days go to taking the list apart, producing exactly what it calls for in a form the auditor can test, and fixing the sampling method before the testing starts. The power of attorney goes in first, so the requests come to us in writing. We inventory the records against the list and the audit period, get the missing bank, card and point-of-sale data, and build the auditor’s reconciliations first, so every difference has a documented reason before the auditor sees it. We index the production by quarter and log what goes out. When the auditor proposes a sample we ask for the plan in writing and check that the periods are representative and that credits in the sample, such as tax paid on purchases, get projected like the errors. Where certificates are missing we gather replacements, and where the auditor sends XYZ letters we reach the customers first.

Do you need a lawyer for a CDTFA records request?

The honest test is what is missing and what the missing records support. A sole proprietor with one year at issue, a small-dollar question and records that only need organizing can produce them with an accountant, and we would say so on the free 15-minute call. It becomes a lawyer matter when the audit period runs more than a year, when a meaningful share of sales were reported as sales for resale and the certificates are incomplete, when cash sales will be tested against a markup, or when the owners of a corporation or limited liability company could be reached personally under section 6829 of the Revenue and Taxation Code once it stops operating. A request for records you know do not exist is a lawyer matter on the day it arrives.

How the monthly flat fee works for a CDTFA records request

Many matters like this one run as a monthly flat-fee engagement: one number, agreed up front, that covers agency contact, deadlines, document responses and strategy until the matter resolves. It does not include the bookkeeping itself, an appeal to the Office of Tax Appeals (OTA) or a separate income tax audit set off by the sales tax findings, each quoted on its own. The engagement ends when the audit closes with no change, when a Notice of Determination is paid or settled, or when you tell us to stop, and the fee stops with it.

Documents to gather

Eight sets of records cover a standard CDTFA request, and the auditor leans hardest on the last three.

  • The sales and use tax returns for every quarter in the audit period, with the worksheets behind them.
  • The federal income tax returns for the same years, whether a Schedule C, a Form 1120 or a Form 1065.
  • The general ledger, trial balance and sales and purchase journals.
  • Bank statements for every business account, with deposit detail, and the card statements and Form 1099-K for each year.
  • Point-of-sale exports: daily closing reports and the item-level sales file if the system keeps one.
  • Resale certificates, matched to the customer and the invoices they cover.
  • Shipping records and exemption certificates behind every other nontaxable sale.
  • Purchase invoices for equipment, fixtures and supplies, especially from out-of-state vendors, for the use tax review.

How does CDTFA audit sampling work?

The auditor tests a portion of the transactions, finds the error rate in it, and projects it across the whole audit period. A block sample takes whole months or quarters, a statistical sample takes a random draw across the period, a markup analysis projects sales from the cost of goods sold, and a bank deposit analysis treats every deposit as a sale until you show otherwise. The sampling plan fixes the method and the periods, and it is far easier to change before the sample is drawn than after.

What happens if my records are missing or incomplete?

The CDTFA estimates, and the burden of proving the estimate wrong shifts to you. Section 6481 of the Revenue and Taxation Code lets the auditor compute the tax from any information available, and section 6091 presumes all gross receipts taxable until you prove otherwise. A reconstruction from bank, card and vendor records is almost always better than the auditor’s estimate, so build one first.

What does a resale certificate have to include to protect me?

The purchaser’s name, address and seller’s permit number, a description of the property, a statement that it is bought for resale, and a signature and date, taken in good faith and in a timely way, which as a rule means before you bill the customer. Section 6092 of the Revenue and Taxation Code relieves you of the burden of proof only if the certificate was taken in good faith from a permit holder who sells that kind of property, and Regulation 1668 sets out the form.

What are the XYZ letters the CDTFA sends to my customers?

XYZ letters are the auditor’s written requests to your customers asking them to confirm whether the goods you sold them without tax were bought for resale. The auditor sends them when a claimed sale for resale has no certificate or a doubtful one, and a customer who answers that the goods were used rather than resold turns that sale taxable in your audit.

Do I have to give the CDTFA auditor my personal bank statements?

Not as a rule, because the request covers the records of the business, and personal accounts come into an audit when business receipts were deposited into them. If they were, the auditor is entitled to trace those deposits, and the better course is to identify the business deposits yourself rather than hand over the whole account.

Can the CDTFA auditor get my bank records without me?

Yes, and the auditor will if the records do not come from you. The CDTFA can obtain bank and card processor records from the institutions that hold them, and it already receives Form 1099-K totals and federal return figures. A production you organize is the only version that comes with your explanation attached.

Related pages

The other steps in a CDTFA sales tax audit, and two guide chapters.

Talk with a CDTFA audit attorney

The first call is free, and we will tell you whether this audit needs a lawyer at all.

As Featured In & Recognized By

Forbes Business Council

Talk to us

The first step is a free 15-minute call

Brotman Law is in San Diego and was founded in 2013. We represent clients anywhere in the country before the CDTFA, and we have resolved 2,200+ matters along the way. The first step is a free 15-minute call with our intake team. From there, the next step is a strategy session with the attorney; if it has no value to you, it is refunded. Book a free 15-minute call.

Scroll to Top