What happens in a New York sales tax audit of a software company?
Edvin Givargis Published 6 minute read
The short answer
A records production with a clock on it, followed by a negotiation conducted in spreadsheets. The audit opens with a records request for the full lookback, typically every sales tax quarter still open, and the leverage is stated early: produce transaction-level detail or the Department will issue an estimated assessment built from whatever it has, bank deposits, federal returns, third-party data, always constructed generously in the state's favor. For a SaaS seller the production is an invoice-detail workbook, every New York-billed line for every period, and the substantive work happens in its columns: which lines are taxable platform receipts, which are exempt services, and, critically, which taxable-looking receipts fall out of the base for reasons the invoice cannot show, because the customer's users sat outside New York or because the customer already self-assessed use tax. Those last two categories are recovered through the audit's most valuable and least known instrument, the customer verification letter, known in the trade as the XYZ letter: a statement the seller's customers complete confirming whether they paid use tax on the invoices at issue and where the software was used, each returned letter deleting its sales from the assessment. Around that core run the negotiations that shape the final number, audit scope, penalty abatement, and the interest rate itself, which in New York is not a fixed fact but a range the Department can moderate for cause.
The production, the marking, and the reconciliation
The workbook is the audit. The seller extracts invoice-level detail for the audit periods, and the taxable/exempt marking of each line is a legal position taken thousands of times at once, which is why the product taxonomy from the companion taxability article should exist before the extraction starts: platform and subscription lines marked taxable, separately stated service lines marked exempt, and the descriptions that will justify each marking cleaned up rather than left in billing-system shorthand, since the auditor reads the description column first and quantity fields that secretly mean months rather than units should be explained or removed before they confuse anyone. Expect the cross-check that catches unprepared sellers: the auditor reconciles the sales schedule against the receipts reported on the seller's New York income and franchise filings, and unexplained gaps between the two become audit issues of their own, so the reconciliation belongs in the production package, prepared by the seller with the differences, timing, non-New York revenue, non-receipt items, labeled. Scope is negotiable at this stage and rarely later: where the earliest periods predate meaningful New York activity, or the records genuinely do not exist, a request to drop periods, made early and to the auditor's supervisor where necessary, trims years off the interest accrual at the cost of one letter.
The XYZ letters, and the endgame worked customer by customer
Sales tax and use tax are complementary, and the assessment can only properly include tax nobody paid. Business customers of a SaaS seller frequently self-assessed use tax on exactly the invoices under audit, and every dollar they paid is a dollar that comes out of the seller's assessment, if it can be proven. The verification letter does that work: sent by the seller to each customer behind the taxable sales, it asks the customer to confirm whether use tax was accrued and paid on the listed invoices and, in the well-drafted version, where the software was used, so that a single mailing collects both defenses, the payment defense and the user-location defense from the companion article. Execution decides the yield. The letter should be one page, effortless to complete, sent to a contact who understands it, the tax or accounting function, not the procurement inbox, tracked, and followed up, because response rate is the whole game; and the seller should sequence deliberately, sending letters only for the sales the marking exercise left in the taxable base, so customers are not asked to paper receipts the seller should have removed itself. What returns falls into three piles: use tax paid, removed from the assessment; used outside New York, removed or reduced under the user-location measure; and neither, which stays in the assessment and opens the audit's uncomfortable final chapter, the seller's right to invoice those customers now for the tax it must remit, a second mailing that mixes law, contract, and customer relations, and that should be planned, worded, and priced before the closing agreement is signed rather than discovered after.
Interest, penalties, and the number that actually gets paid
The gap between the auditor's schedule and the check the seller writes is negotiated in three lines. Penalties are the softest: a first audit, a taxability question the seller could reasonably have gotten wrong, remotely accessed software being the canonical example, and cooperative production make the standard reasonable-cause abatement case, and it should be made in writing. Interest is harder but not fixed: New York's statutory rate on sales tax assessments runs punishingly high, but the Department has discretion to apply a reduced rate down to the statutory floor where the circumstances warrant, and the request, framed on the same reasonable-cause facts, converts directly into money across a multi-year accrual. Scope, already negotiated, does the rest. What is not negotiable is worth stating to every client at the outset: sales tax is a trust-fund-style liability with responsible-person exposure attached, the assessment against the company can be mirrored against the individuals who ran it, and settling the company's number without confirming the treatment of the officers is finishing the audit while leaving its most personal risk open. If agreement fails, the road runs through the Bureau of Conciliation and Mediation Services and on to the Division of Tax Appeals, but the economics of interest accrual mean most software audits settle in the workbook, which is why the workbook, the letters, and the marking discipline are where the representation earns its fee.
Practice notes
The sequence that minimizes the number: stabilize communication with the auditor immediately, an audit inherited mid-stream or gone quiet is an estimated assessment ripening; produce the invoice detail on the taxonomy, with the income-return reconciliation attached before it is requested; negotiate scope early; run the letter program with the discipline of a collections campaign; then close on penalties and the interest rate with the reasonable-cause memo in hand. Prospectively, every element of the audit converts into a control: the taxonomy becomes billing configuration, the user-location declaration moves onto the order form, the use-tax question gets asked at sale instead of by letter years later, and the seller's next New York audit, and there is always a next one, becomes a production rather than a reconstruction.
This article states the law as of September 16, 2026
Statutes, rates, thresholds, and agency practice change, and a different set of facts can change the answer. Before acting on anything discussed above, contact G&G State Tax Group to confirm what has changed since this was written and how the rules apply to a specific situation.
G&G State Tax Group, LLC is a state and local tax advisory firm. The firm provides state and local tax consulting and representation in state and local tax controversies. G&G does not prepare or file tax returns, perform attest services, or provide bookkeeping, and is not a CPA firm.