Of everything that gets flagged in a sales tax audit, exemption certificates are one of the most avoidable and one of the most common. A client sells to a wholesaler, doesn't collect tax because the sale is exempt, and never actually collects the certificate proving the exemption was valid. Nothing goes wrong for years. Then an auditor asks for the certificate that was on file at the time of the sale, it doesn't exist, and every exempt sale in that relationship is on the table as taxable. The cost was never the certificate. It's every sale sitting behind it.
Certificates aren't a one-time collection. Many expire or need renewal on a set cycle depending on the state and the certificate type, and a wholesale relationship running three years without anyone checking is a common way this quietly breaks. New customers get onboarded without a certificate being requested at all, because sales and bookkeeping are focused on getting the order processed, not on documentation. Product lines shift, and an exemption that applied to one item doesn't automatically extend to a new one added later.
None of that shows up as a problem day to day. It shows up entirely at audit, which is the worst possible moment to find it.
An auditor isn't just confirming a certificate exists somewhere in a file. They're checking that it supports the specific sale: that it matches the buyer and what was actually sold, that the exemption claimed was available in that state on that date, and that it hasn't lapsed under that state's rules.
There's a piece here that gets misstated often enough that I want to be precise about it. Missing a certificate at audit is not automatically fatal. Under the Streamlined Sales and Use Tax Agreement, and in many states outside it, a seller generally gets a window after the state requests substantiation, commonly at least 120 days, to go obtain a completed certificate accepted in good faith. The paperwork can sometimes be cured after the fact.
What makes it risky is everything around that window. Good faith has actual conditions: the exemption has to have been statutorily available on the transaction date, plausible for the item sold, and reasonable for that buyer's line of business. And practically, you're asking a customer, sometimes a former customer, to sign paperwork for a purchase they made three years ago with nothing in it for them. Some will. Plenty won't respond at all. The window is real, but you don't want to be the firm whose plan depends on it.
This is one of the cheapest fixes in sales tax compliance and one of the most commonly skipped. A workable process needs an owner, meaning someone whose job includes confirming a certificate exists before an exempt sale is processed, not after. It needs a renewal cadence tied to each certificate's expiration rather than a one-time grab at onboarding. And it benefits enormously from living in a system rather than a shared drive folder, because expiration dates and renewal reminders are exactly the kind of detail that disappears without something surfacing them.
Automation earns its keep here more than almost anywhere else in compliance, because the failure mode isn't a hard judgment call. It's a reminder nobody set. Something that flags an expiring certificate before it lapses closes the single most common way this gap opens.
Part of what makes this hard is that "exemption certificate" covers several different things depending on the state and the reason for the exemption. A resale certificate covers goods bought for resale. Manufacturing and agricultural exemptions use their own forms. Some states accept a multi-jurisdiction certificate covering several states at once, while others require their own state-specific version and won't take the multi-jurisdiction alternative.
A client operating across a dozen states can easily be holding a mix of valid and invalid paperwork for the exact same customer, purely because the certificate type didn't match what that particular state requires. This is where the shared drive folder breaks down fastest. One certificate on file for a customer tells you nothing about whether it's the right certificate for every state that customer buys from, and checking that by hand across a real customer base isn't realistic without something tracking certificate type against jurisdiction.
Certificate management is easy to overlook because it isn't the interesting part of sales tax advisory. It's not a nexus study or a multi-state strategy conversation. But it's exactly the kind of gap that turns into real dollars at audit, and catching it costs close to nothing next to fixing it afterward. Firms that build this into standing client service, even as a quiet, unglamorous piece of the offering, are protecting clients from exposure that's entirely preventable and entirely common.
The clients who get burned by this rarely did anything wrong on purpose. They just never had anyone checking, until someone from the state did.
Sponsored Content: This article is generously brought to you by one of our valued sponsors. Their support enables us to continue delivering expert insights and the latest industry trends to our dedicated community of accounting professionals.