What happens in a New York sales tax audit of a software company?

The production, the marking, and the reconciliation

The workbook is the audit. The seller extracts invoice-level detail for the audit periods, and the taxable/exempt marking of each line is a legal position taken thousands of times at once, which is why the product taxonomy from the companion taxability article should exist before the extraction starts: platform and subscription lines marked taxable, separately stated service lines marked exempt, and the descriptions that will justify each marking cleaned up rather than left in billing-system shorthand, since the auditor reads the description column first and quantity fields that secretly mean months rather than units should be explained or removed before they confuse anyone. A cross-check worth anticipating is the reconciliation of the sales schedule against the receipts reported on the seller's New York income and franchise filings: unexplained gaps between the two invite audit issues of their own, so the reconciliation belongs in the production package, prepared by the seller with the differences, timing, non-New York revenue, non-receipt items, labeled.

Scope has two dimensions, periods and method, and both are most negotiable at the start. Where the earliest periods predate the seller's vendor status, there was no duty to collect, and a request to drop those periods, made early and to the auditor's supervisor where necessary, trims years off the interest accrual at the cost of one letter. Missing records work the other way: inadequate or unavailable records do not take a period out of the audit, they invite an estimate, because the Department may determine the tax from such information as may be available, external indices included (Tax Law section 1138(a)(1)), and where no return was filed for a period the tax may be assessed at any time (Tax Law section 1147(b)); the ordinary assessment limitation is otherwise three years. Method is the second dimension. Where the seller's records are complete and adequate, the Department may audit by test period or statistical sample only on the seller's knowing written consent, a consent that must disclose the right to a detailed audit based on all of the records, and the consent binds once the Department has performed under it (Matter of Wallach v. Tax Appeals Tribunal, 206 AD2d 696 (3d Dept 1994); Matter of Top Drawer Custom Cabinetry Corp., N.Y. Tax App. Trib., Nov. 19, 2015). Written consents extending the assessment period deserve the same deliberation before signing; a signed extension keeps the assessment period open but also holds the refund window open for six months past the extended period (Tax Law section 1147(c)).

The customer verification letters, and the endgame worked customer by customer

Sales tax and use tax are complementary, and the assessment can only properly include tax nobody paid. Business customers of a SaaS seller may already have self-assessed use tax on the invoices under audit, and every dollar they paid is a dollar that comes out of the seller's assessment, if it can be proven. The verification letter does that work: sent by the seller to each customer behind the taxable sales, it asks the customer to confirm three things, whether use tax was accrued and paid on the listed invoices, where the software was used, and whether the customer was audited by the Department for the same period and agreed to the findings, so that a single mailing collects the payment defense, the user-location defense from the companion article, and the overlapping-audit ground that New York case law has credited. The instrument has no statutory name in New York; it is an audit practice rather than a prescribed procedure. Practitioners sometimes borrow a California label and call it an XYZ letter, after California Code of Regulations, title 18, section 1668(f), under which a seller that lacks a timely resale certificate may send its purchasers a letter, in a form approved by the Board of Equalization (now the California Department of Tax and Fee Administration), asking whether the property was bought for resale or for use and, if for use, whether the purchaser paid the tax directly. New York has no counterpart regulation prescribing the letter, and its published guidance does not use the label, so the letter in a New York audit is a documentation practice that rests on the burden of proof in Tax Law section 1132(c)(1). Two neighboring categories are covered by rule, and the letter program is properly aimed only at customers outside them: a direct payment permit waives the vendor's collection responsibility on receipt of the permit (Tax Law section 1132(c)(2); 20 NYCRR 532.5(a)), and resale, exempt-organization, and production or research exemption certificates received not later than 90 days after delivery take their sales out of the question, with a timely but deficient certificate curable later (Tax Law section 1132(c)(1)).

Execution decides the yield. The letter should be one page, effortless to complete, sent to a contact who understands it, the tax or accounting function, not the procurement inbox, tracked, and followed up, because response rate is the whole game; and the seller should sequence deliberately, sending letters only for the sales the marking exercise left in the taxable base, so customers are not asked to paper receipts the seller should have removed itself. What returns sorts into three groups, and none of them sorts itself. New York Tax Law section 1132(c)(1) presumes that all receipts are taxable until the contrary is established, and it puts the burden of proving a receipt not taxable on the person required to collect the tax or on the customer. A customer letter is evidence, not an automatic removal. In Matter of Gartner Group (N.Y. Tax App. Trib., Dec. 8, 1994), the Tax Appeals Tribunal accepted uncontroverted customer letters stating that the customer had been audited for the same period as "sufficient to prove" that the vendor was entitled to an audit adjustment under the Division's overlapping-audit policy, and it gave no adjustment for letters stating that the tax was not paid or not assessed. A substantiated use tax payment, backed by the customer's return, accrual schedule, or remittance record, supports taking those sales out of the assessment, and substantiated use outside New York supports removal or reduction under the user-location measure. The user-location side demands the same substantiation. In Matter of NetVoyage Corp. (N.Y. Tax App. Trib., Aug. 27, 2026), the Tribunal sustained a full assessment against a cloud software seller that argued for apportionment by user location but never produced statements from its customers breaking down their users inside and outside New York; the Division, which had built the audit on New York billings, rejected the seller's proposed shortcut in writing with "we cannot accept this simplified allocation." The rule also runs in both directions: the Department sources remotely accessed software to the location of the users (TB-ST-128), so the same letters can surface New York users behind accounts billed outside New York, and an auditor is entitled to ask about them. The rest, the letters that come back bare, the ones that come back the wrong way, and the ones that never come back at all, stays in the assessment and opens the audit's uncomfortable final chapter: the seller's ability, subject to its contracts, to invoice those customers for the tax it must remit. Article 28 makes the customer who did not pay liable for the tax (Tax Law section 1133(b)), but it grants the vendor no post-audit billing right of its own, so that second mailing mixes contract, general law, and customer relations, and it should be planned, worded, and priced before the closing agreement is signed rather than discovered after. Running the letter program as a documentation exercise rather than as a poll is what converts responses into removals.

Interest, penalties, and the number that gets paid

The gap between the auditor's schedule and the check the seller writes is negotiated in three lines. Penalties are the softest: a first audit, an arguable taxability question, and cooperative production make the standard reasonable-cause abatement case, and it belongs in writing; the regulation weighs the seller's compliance record and provides that the absence of willful neglect alone is not sufficient (20 NYCRR 2392.1). The arguable questions are narrower than they once were. The Department has treated remotely accessed prewritten software as taxable and sourced it to user location in published guidance since 2014 (TB-ST-128), and the Appellate Division sustained the taxability of a SaaS bundle in Matter of Beeline.com, Inc. v. State of New York Tax Appeals Tribunal, 2026 NY Slip Op 00175 (3d Dept, Jan. 15, 2026), so the reasonable-cause case for a software seller is built on bundling and allocation questions, not on whether remote access is taxable at all. The penalty structure is also wider than the late-payment penalty alone: Tax Law section 1145(a)(1)(i) imposes that penalty at 10 percent of the tax due plus 1 percent for each additional month, capped at 30 percent, and section 1145(a)(1)(vi) adds a substantial understatement penalty of 10 percent where the understatement exceeds 25 percent of the tax required to be shown, reduced for positions with substantial authority and remitted for reasonable cause. Interest is harder but not fixed: Tax Law section 1145(a)(1)(ii) charges interest at the greater of 14.5 percent or the underpayment rate set by the commissioner under section 1142, a rate that follows section 1096(e) and cannot fall below 7.5 percent (section 1142(9)), and where the Department finds that the failure was due to reasonable cause and not willful neglect, section 1145(a)(1)(iii) requires it to remit the penalty and the interest above that underpayment rate. The same reasonable-cause showing therefore does double work, and its interest value depends on the spread between the two rates: for the fourth quarter of 2026 the Department's posted rates are 14.5 percent for sales tax late payments and assessments and 11 percent as the section 1096(e) rate, a reduction of 3.5 points per year of accrual, so on a long accrual the interest reduction can be worth more than the penalty, and on a short one it is not. Scope, already negotiated, does the rest.

What is not negotiable is worth stating at the outset of every audit. The vendor collects the tax as trustee for the state (Tax Law section 1132(a)(1)), responsible-person exposure attaches, and the assessment against the company can be mirrored against the individuals behind it, a class that reaches officers, directors, and employees under a duty to act and extends to any partner or limited liability company member without a duty-to-act qualifier (Tax Law section 1131(1)), a point with consequence for the many software sellers organized as LLCs. Settling the company's number without confirming the treatment of those individuals is finishing the audit while leaving its most personal risk open. If agreement fails, the notice of determination becomes a fixed assessment 90 days after mailing (150 days where the notice is addressed outside the United States) unless the seller petitions the Division of Tax Appeals within that period or, at its option, first requests a conciliation conference with the Bureau of Conciliation and Mediation Services, a request that suspends the running of the time to petition (Tax Law sections 1138(a)(1), 170(3-a)). The economics of interest accrual mean that many software audits settle in the workbook, which is why the workbook, the letters, and the marking discipline are where the representation earns its fee.

Practice notes

The sequence that minimizes the number is a settled one: communication with the auditor stabilized immediately, since an audit inherited mid-stream or gone quiet is an estimated assessment ripening; invoice detail produced on the taxonomy, with the income-return reconciliation attached before it is requested; scope and method negotiated early, with any test-period, sampling, or period-extension consent read against the rights it gives up before it is signed; the letter program run with the discipline of a collections campaign; and the close made on penalties and the interest rate with the reasonable-cause memo in hand. Prospectively, every element of the audit converts into a control: the taxonomy becomes billing configuration, the user-location declaration moves onto the order form, the use-tax question gets asked at sale instead of by letter years later, and the seller's next New York audit becomes a production rather than a reconstruction. G&G State Tax Group provides sales tax audit representation for software and SaaS sellers alongside its state and local tax practice.