A CDTFA audit is the California Department of Tax and Fee Administration testing whether your business reported and paid the sales tax it actually owed — and the auditor’s estimate methods, not your records, are usually where the number goes wrong.
Here’s the actual issue: when the CDTFA doubts your records, it does not have to use them. It can estimate your taxable sales with indirect methods — a markup analysis on your purchases, an observation test of a few business days projected across three years, credit-card ratios, or bank deposit analysis. Each method has assumptions, and every assumption is attackable. Most of the audit defense work we do is exactly that: forcing the estimate back toward reality.
How a CDTFA audit unfolds
It starts with an engagement letter and a records request — typically sales and use tax returns, federal income tax returns, sales journals, purchase invoices, resale certificates, and POS data for a three-year period. The auditor tests your reported sales against the indirect methods above, issues audit working papers, and holds an exit conference. If you disagree with the result, the Notice of Determination starts a 30-day clock to file a petition for redetermination — miss it and the assessment becomes final. From there the path runs through appeals conferences, settlement review, and the Office of Tax Appeals.
Where audits are won
Three places, in order. The sample: if the observation test caught your two best days, or the markup came from a vendor mix you no longer sell, the projection is wrong and provably so. The documentation: resale and exemption certificates cure “unsupported” exempt sales — and California lets you obtain corrected certificates during the audit (XYZ letters to your customers). The procedure: deadlines, waiver decisions, and what you volunteer in the opening interview shape everything downstream. What you say to the auditor in week one is the cheapest thing to get right and the most expensive thing to get wrong.
What a CDTFA audit can turn into
Two escalations matter. If the business cannot pay the final assessment, the CDTFA can pursue owners and officers personally under Revenue and Taxation Code § 6829 — the responsible-person assessment. And where the auditor believes underreporting was intentional (two sets of books, POS suppression, unreported cash), the file can be referred for criminal investigation. Both are reasons to treat a “routine” audit with cash-heavy facts seriously from day one.
Since 2013 we have represented 400+ clients in audits across the IRS and the California agencies — restaurants, contractors, retailers, and e-commerce sellers make up most of the CDTFA side of that book. The audit work runs on flat-fee and monthly engagement options, quoted before you sign.
How engagements work
Many matters like this one run as a monthly flat-fee engagement: one number, agreed up front, that covers the work — agency contact, deadlines, document responses, strategy — until the matter resolves. Shorter, well-defined projects are often a one-time flat fee instead, and some matters genuinely fit hourly billing better. We will tell you which you are looking at on the first call, before you commit to anything. If you want the details first, see how we price our work.
In a CDTFA audit right now?
Tell us what stage it is at. We respond to new inquiries within one business day.
More depth: the full audit process · what triggers a CDTFA audit · how markup tests work · our California sales tax practice.
By Sam Brotman, JD, LLM, MBA — managing attorney, Brotman Law. CA Bar No. 274966. Last updated August 29, 2026.
