You have thousands of exemption certificates on file. Your customers submitted them, your team stored them, and you assumed you were covered. So why did the audit letter still show up?
Because having a certificate on file and having a valid certificate on file are two different things.
States have gotten significantly more precise about what they want from exemption documentation. The certificate your customer submitted in 2019 might be expired, incomplete, tied to a lapsed permit, or simply not valid for the type of transaction it’s covering. Auditors know exactly where to look, and they’re looking more often.
This guide covers what triggers audit adjustments on exemption certificates, how state verification has changed, and what a proactive review of your own files should look like before an auditor does it for you.
Why States Are Paying Closer Attention
The short answer is money. Invalid exemption certificates represent uncollected revenue at scale, and states have realized that even a small error rate across thousands of B2B transactions adds up fast.
A few things accelerated this shift.
Economic nexus expanded the documentation gap. After the 2018 South Dakota v. Wayfair decision, businesses scrambled to register in new states. Many didn’t update their exemption certificate collection processes to match. That created a documentation gap that auditors are now working through.
State verification technology improved. Many states now maintain digital databases of registered exempt entities and can cross-reference your exempt sales against those records during an audit. An exemption number tied to a revoked or expired permit gets flagged immediately. Pattern recognition tools help auditors identify high volumes of exempt sales, unusual exemption types, or discrepancies between reported sales and industry norms.
Remote selling and new transaction types changed the rules. Drop shipping, marketplace sales, and digital commerce introduced transaction structures that existing certificates often don’t cover. States updated their rules, but many businesses haven’t updated their documentation.
States aren’t just checking whether you have a certificate on file. They’re verifying that it’s current, properly completed, applicable to the specific transaction, valid for the state where the sale occurred, and supported by the customer’s actual exempt status. If any of those elements are missing or questionable, you’re looking at an audit adjustment.
The Most Common Documentation Gaps
Expired or stale certificates. Expiration rules vary significantly by state and certificate type, so there’s no single rule that applies everywhere. But the pattern is consistent: businesses collect certificates at the start of a customer relationship and never revisit them. Some states have hard expiration dates. Others have recommended renewal intervals that, while not strictly mandatory, leave old certificates vulnerable during an audit. A few examples of how this plays out in practice:
Florida’s standard Annual Resale Certificate expires every December 31 and must be renewed annually. Florida’s Consumer’s Certificate of Exemption (for nonprofits, government entities, etc.) expires every five years. Texas resale certificates don’t carry a fixed expiration date — they remain valid as long as the buyer’s information is current and their permit is active — but the underlying seller’s permit can lapse, which invalidates the certificate. Illinois recommends certificates of resale be updated at least every three years; this is guidance rather than a hard statutory deadline, but auditors treat stale certificates as a risk factor. New York resale certificates don’t expire on their own, but they become invalid if the buyer’s Certificate of Authority lapses, which the state renews on its own schedule.
The takeaway isn’t to memorize every state’s rules. It’s to have a system that tracks what you have on file, when things were last updated, and which customers are operating in states where renewal matters.
Incomplete or unsigned certificates. A certificate with blank fields is almost as bad as no certificate at all. Auditors look for complete customer name and address, a valid exemption number or clearly stated reason for exemption, a proper signature, a description of the products or services being purchased exempt, and the date it was executed. Blanket certificates — where a customer provides one document to cover all future purchases — are valid in many states, but they still need to be fully completed and clearly indicate they’re intended for ongoing use.
Wrong certificate type for the transaction. A resale certificate doesn’t cover manufacturing equipment purchases. An agricultural exemption doesn’t apply to office supplies. A nonprofit exemption might not cover every category of goods. Auditors regularly find businesses that accepted a valid certificate but applied it to transactions it wasn’t designed to cover. This happens most often when customers have multiple exemption types, when product lines have changed over time, or when new transaction types were added without updating documentation.
Certificates that don’t match the selling state. A certificate issued by a customer in State A doesn’t protect you on sales delivered to State B. This is especially common with drop shipping, multi-location customers, and marketplace sales where the delivery destination varies. You need a certificate valid for the state where the sale occurs — typically wherever the goods are delivered.
Customers whose exempt status has changed. Sometimes the certificate is perfectly completed and current. But the customer’s resale permit has been revoked, or their nonprofit status has lapsed. States can verify exemption numbers against their own records. If the status doesn’t check out, the certificate won’t protect you.
How to Review Your Own Files Before an Auditor Does
Step 1: Build a complete inventory. Start by listing every exemption certificate you have on file. For each one, document the customer name and account number, the state or states covered, the type of exemption claimed, the date it was executed, any expiration date, and whether it’s a blanket or single-purchase certificate. This exercise often surfaces gaps no one knew existed.
Step 2: Flag expired and aging certificates. Using your inventory, identify any certificates that have already expired under state-specific rules, any that will expire within the next 12 months, and any that haven’t been updated in several years regardless of formal expiration rules. These are your highest-priority items for renewal outreach.
Step 3: Review for completeness. Pull a sample of certificates, focusing on your highest-volume exempt customers and states where you have significant exposure. Check each one for all required fields, a valid signature, a clearly stated exemption reason, and a product or service description that matches what you actually sell to that customer.
Step 4: Verify the certificate type matches the transaction. For each certificate you sample, compare the exemption type against the actual transactions you processed for that customer. Does the resale certificate cover everything you sold exempt? If the customer claims a manufacturing exemption, are all exempt purchases actually going into manufacturing? If they have multiple locations, do you have certificates for each relevant state?
Step 5: Validate exemption numbers for high-volume customers. Many states offer online lookup tools where you can confirm that a resale permit or exemption number is currently active. This step takes more time but provides the strongest protection against audit adjustments.
Step 6: Document your process. Whatever you find, write it down. Record when you conducted the review, what you sampled, what issues you found, and what you did to fix them. This documentation shows auditors you’re actively managing compliance, which matters.
Drop Shipping and Marketplace Sale
These two transaction types deserve special attention because they create exemption certificate challenges that standard processes often miss.
Drop shipping. When your customer orders from you and you direct your supplier to ship directly to them, you have three parties and two transactions — and multiple states with questions about who owes what. In a typical drop shipping arrangement, you need to provide your supplier with documentation showing that the sale to your end customer is exempt or that you’ll handle the tax obligations. You also need to collect proper documentation from your end customer if they’re claiming an exemption.
Most states accept a drop shipment exemption certificate that the retailer provides to the supplier, essentially confirming you have nexus in the destination state and will handle the tax. But the specifics vary — some states require their own certificate form, others accept a standard resale certificate with additional documentation. The safest approach is to maintain separate documentation for drop shipping transactions, including the certificate you provide to your supplier, the certificate you collect from your end customer when applicable, and records showing you collected tax or have valid exemption documentation for each transaction.
Marketplace sales. In most states, marketplace facilitators are now responsible for collecting and remitting sales tax on behalf of their sellers. This means platforms like Amazon handle the tax calculation and collection for transactions through their platform. But when a customer is exempt, someone still needs to collect and validate that exemption certificate. Most major marketplaces have their own exemption programs — Amazon Business, for example, handles this directly with qualifying buyers.
The audit risk is that you may not have visibility into which of your marketplace sales were processed as exempt, and auditors may ask about those transactions. Maintain records of which marketplaces you sell through, what exemption certificate programs they offer, and any direct communications with exempt customers who also buy through marketplace channels.
Building a System That Holds Up
Fixing your current certificate files matters. So does building processes that prevent the same gaps from reappearing.
Centralize everything. If certificates are scattered across file cabinets, email folders, and individual drives, you can’t manage them systematically and auditors can’t review them efficiently. One system of record with consistent naming conventions and clear ownership is the foundation for everything else.
Automate expiration tracking. Manual tracking doesn’t scale. As your customer base grows and you expand into more states, you need systems that flag approaching expiration dates, generate renewal requests, and report on certificate status across your book of business. Whether that’s a dedicated certificate management platform, a module within your ERP, or well-maintained shared tooling, the key is that it runs without someone having to remember.
Build certificate collection into how you sell. The best time to collect an exemption certificate is before the first exempt transaction occurs — during customer onboarding, in the sales order workflow, or at B2B checkout. Making it a standard part of the process is easier than chasing certificates retroactively.
Review regularly. State rules change. Florida’s annual resale certificate requirement has caught businesses off guard. Washington’s ESSB 5814 expansion in late 2025 changed what services are even taxable there, which has downstream effects on what documentation you need. A quarterly review of your highest-risk states and an annual review of everything else is a reasonable baseline for most businesses.
Exemption Certificate Compliance Checklist
Use this to assess where your process stands and where to focus first.
Certificate inventory
- We have a complete list of every exemption certificate on file
- All certificates are stored in one centralized system
- We can retrieve any certificate quickly for any exempt customer
Currency and validity
- We track expiration dates for all certificates
- We have a process for requesting renewals before certificates lapse
- Certificates that haven’t been updated in several years have been reviewed
Completeness
- All certificates have complete customer information
- All certificates have valid signatures
- Exemption reasons are clearly documented
- Product or service descriptions match what we actually sell exempt
State-specific compliance
- We have certificates valid for each state where we make exempt sales
- We understand which states have annual or periodic renewal requirements
- We use state-specific forms where required
Transaction matching
- Certificate types match the transactions we process exempt
- We have proper documentation for drop shipping arrangements
- We understand our exemption documentation obligations for marketplace sales
Verification
- We verify exemption numbers for high-volume customers
- We have a process for handling invalid or revoked exemptions
- We document our verification efforts
Ongoing management
- Certificate collection is part of our customer onboarding process
- Expiration tracking is automated
- We review our certificate files regularly
- We monitor state rule changes that affect exemption requirements
When to Ask for Help
Managing exemption certificates across multiple states is complex. A few signs it may be time to bring in outside support: you’re operating in more than ten states and struggling to track varying requirements, you’ve received an audit notice that includes exemption certificate questions, you’re expanding into drop shipping or marketplace sales and aren’t confident in your documentation, or you’ve found significant gaps in your files and aren’t sure where to start.
A sales tax consultant can assess your current processes, identify your highest-risk areas, help develop compliant documentation procedures, and respond to audit inquiries. The goal is targeted support that builds lasting habits, not permanent outsourcing.
If you want to figure out where you stand before an auditor does, a free What’s Next consultation with one of our sales tax experts is a good place to start. We’ll look at your situation, answer your questions, and tell you exactly what needs to happen.
Schedule your free What’s Next consultation with The Sales Tax People.
The post Exemption Certificate Management: What Auditors Actually Look For appeared first on The Sales Tax People.