The Exemption Certificate Expired Two Audits Ago
The customer said they were exempt, someone filed a certificate, and nobody checked it again. Three years later the auditor samples twenty invoices and the certificate does not cover them.
An exemption certificate is the documentation supporting why tax was not charged on a sale. In an audit the seller carries the burden of producing a valid certificate for each exempt transaction, and where one cannot be produced the tax, interest and penalties generally fall on the seller rather than the customer. Certificates fail on four grounds: missing, expired, incomplete, or valid but not covering the jurisdiction or item actually sold.
- The exposure sits with the seller. An exempt sale without a valid certificate becomes an assessment against you, not the customer.
- Four failure modes: missing entirely, expired, incomplete on its face, or valid but not covering that jurisdiction or product.
- The fourth is the one that surprises teams. A certificate on file is not the same as a certificate that covers the transaction.
- Certificates expire on rules that differ by jurisdiction and by certificate type, which is why a single renewal reminder rule produces gaps.
- ChatFin reads certificates as documents, tests each exempt transaction against the certificate that should support it, and produces the gap list before an auditor does.
Exemption certificates are filed with relief and then forgotten. The customer pushed back on tax, somebody produced a document, the invoice went out without tax, and the matter closed.
The problem is that the document was evidence of a state of affairs on a particular date, for particular jurisdictions, covering particular items. Customers change entity names, expand into new states, alter what they buy from you, and let registrations lapse. The certificate does not follow any of that. It sits in a folder saying what it said on the day it was signed.
This page covers the four ways certificates fail, why the coverage question is the one most teams have never tested, how the tooling handles this today, and how to produce your own gap list before somebody else produces it for you.
The four ways a certificate fails
Auditors do not usually find creative problems. They find the same four, and only one of them is obvious from a quick look at the file.
Missing
No certificate at all for an exempt sale. Often because the exemption was applied verbally at order entry and the document was never chased once the invoice went out.
Expired
A certificate that was valid and no longer is. Expiry rules vary by jurisdiction and certificate type, so a single renewal rule leaves gaps.
Incomplete
Missing signature, missing date, missing registration number, or a reason for exemption that is not stated. Invalid on its face regardless of intent.
Not covering the transaction
A valid certificate that does not extend to the jurisdiction the goods shipped to, or to the type of item sold, or to the entity that was actually invoiced.
The fourth failure is where the largest assessments come from, because the certificate exists and everyone assumed the matter was settled. Nobody tested whether it covered the specific transactions it was being relied on for.
Audits arrive years later
An expired certificate causes no trouble until an auditor samples the invoice it covered three years ago.
I'll really date myself there because the firm is long gone, but I worked as an auditor.
Caitlin Haberberger, on the AgentCFO podcast
Run an expiry report against open customers each quarter, and treat a missing certificate as a billing hold.
Coverage is a per transaction question
A certificate has a scope. It names an entity, one or more jurisdictions, a basis for exemption and often a category of purchase. Every exempt sale needs to sit inside that scope.
Testing five conditions across every exempt transaction is not analytically hard. It is simply beyond what anyone will do manually, which is why it does not get done until an auditor selects a sample and does it for you on the transactions least favourable to you.
Why one renewal rule is not enough
Teams that manage certificates at all usually set a single reminder period and renew everything on that cycle. It is better than nothing and it still leaves gaps, because validity is not a single rule.
| Jurisdiction rules | Some jurisdictions specify a validity period, others treat certificates as valid until revoked, and the practical expectations differ again |
| Certificate type | Blanket certificates covering ongoing purchases behave differently from single purchase certificates |
| Customer change events | A merger, a name change or a new registration invalidates a certificate before any expiry date |
| Dormancy | A blanket certificate relied on after a long gap in trading is weaker evidence than one supported by continuous activity |
| Registration status | The underlying registration the certificate depends on may have lapsed even where the document has no expiry date |
The third row is the one that catches teams with otherwise good processes. Nothing in a renewal calendar knows that a customer restructured, and the first sign is often the invoice going to a slightly different entity name that nobody questioned.
What the tax engines do well
This is a mature software category and the leaders are strong. Avalara, particularly through its certificate management product, along with Vertex, Sovos and Thomson Reuters ONESOURCE, handle collection, storage, validity rules by jurisdiction and renewal workflows, and integrate with the tax determination that decides whether tax should apply in the first place.
If you have material exempt sales and no certificate management tool, buying one is the right first move. The residual gap is not with the engine, it is with what sits outside it: certificates collected before implementation, exemptions applied manually at order entry that bypassed determination, and customers whose invoicing entity does not match the certificate holder.
Finding the transactions that escaped the process is a reconciliation between the billing data and the certificate population, which is what ChatFin does across the ERP and the document store.
Producing your own gap list
The objective is a defensible list of exempt transactions with no supporting certificate, ranked by exposure, that you produce before an audit rather than during one. Two things change when you have it.
First, gaps become recoverable. A customer will usually provide a missing certificate when asked cooperatively, and many jurisdictions accept certificates obtained after the sale within limits. Second, the remaining exposure becomes quantifiable, which is what allows an appropriate reserve rather than a surprise.
| Population | Every transaction where tax was not charged, across all jurisdictions and all periods still open to assessment |
| Match | The certificate relied on for each, tested on entity, jurisdiction, basis, item scope and date |
| Gap classification | Missing, expired, incomplete or not covering, since each carries a different remediation path |
| Exposure | Tax at the applicable rate, plus interest, ranked so remediation effort goes where it matters |
| Remediation status | Certificate requested, received, or exposure accepted, tracked to completion |
Ranking by exposure matters. A long list of small gaps in one jurisdiction and three large ones in another are not the same problem, and treating them with equal urgency is how remediation programmes stall.
How ChatFin tests certificates against transactions
ChatFin reads the certificates themselves as documents, wherever they are held, including scanned files, email attachments and shared folders. The document processing agent extracts the entity, jurisdictions, exemption basis, signature and date fields into a structured record, which is the step that makes testing possible at all.
The autonomous reconciliation agent then matches every exempt transaction in the ERP against the certificate that should support it, testing all five conditions rather than merely checking that a certificate exists for the customer. The pattern recognition agent flags customers whose invoicing entity has changed and jurisdictions where exempt sales are occurring with no certificate on file at all.
| Document processing | Extracts entity, jurisdiction, basis, item scope, signature and dates from certificates in any format |
| Reconciliation agent | Tests every exempt transaction against the supporting certificate on all five conditions |
| Pattern recognition | Flags entity name changes, new shipping jurisdictions and exemptions applied without a certificate |
| Data query agent | Answers questions such as which exempt sales this year have no valid supporting certificate |
| Governed write back | Prepares reserve entries and customer certificate requests for a person to approve |
Nothing is filed or posted automatically. The gap list, the certificate requests and any reserve entry are prepared for review, and a person decides what goes to the customer and what goes to the ledger.
Getting to a clean position
Work backwards from exposure rather than forwards from the filing cabinet.
Quantify exempt sales by jurisdiction
Start with where the money is. A jurisdiction with material exempt sales and few certificates on file is the priority regardless of certificate count.
Extract what you hold
Turn the certificate population into structured records with entity, jurisdiction, basis and dates. Include the folders and mailboxes outside the tax engine.
Test coverage, not existence
Match transactions to certificates on all five conditions. Expect the not covering category to be larger than the missing category.
Request and reserve
Approach customers for the recoverable gaps promptly, and reserve for what remains rather than leaving it undocumented.
Doing the second step properly is what makes the exercise repeatable. Once certificates exist as structured records, the coverage test can run every period instead of once before an audit.
A certificate on file is not the same as a certificate that covers the sale. Auditors test the second, and most teams have only ever checked the first.
ChatFin
Frequently Asked Questions
Who is liable if an exemption certificate is invalid?
Generally the seller. In a sales tax audit the seller carries the burden of producing valid documentation for each transaction where tax was not charged, and where that documentation cannot be produced or does not support the exemption claimed, the tax along with interest and penalties is typically assessed against the seller. Recovering it from the customer afterwards is a commercial matter with no certainty of success.
How often do exemption certificates need to be renewed?
It varies by jurisdiction and by certificate type, which is why a single organisation wide renewal rule leaves gaps. Some jurisdictions specify a validity period, others treat certificates as valid until revoked, and blanket certificates covering ongoing purchases behave differently from single purchase ones. Separately, customer events such as a merger, a name change or a lapsed registration can invalidate a certificate regardless of any date on it.
What is the most common exemption certificate problem?
Certificates that exist and do not cover the transaction they are being relied on for. The customer is exempt in one state and you shipped to another, or the exemption covers production equipment and the invoice included items outside that scope, or the invoice went to an affiliate rather than the entity named on the certificate. Because a certificate is on file, nobody questions it until an auditor tests coverage rather than existence.
Can ChatFin read exemption certificates from a shared folder?
Yes. ChatFin reads certificates as documents wherever they are held, including scanned files, email attachments and shared folders outside your tax engine, and extracts the entity, jurisdictions, exemption basis, signature and validity dates into structured records. It then tests every exempt transaction in the ERP against the certificate that should support it and produces a classified gap list.
This article is general information for finance and accounting teams. It is not accounting, tax or legal advice. Confirm the treatment of your own facts with your auditors and advisers.
See ChatFin test your exempt sales against the certificates on file.
ChatFin extracts your certificate population into structured records, including the files sitting outside your tax engine, and tests every exempt transaction on entity, jurisdiction, basis, item scope and date.
The output is a classified gap list ranked by exposure, with certificate requests and any reserve entry prepared for a person to approve.
Book a DemoBring a certificate folder and an exempt sales extract.
ChatFin will structure the certificates, test coverage across every exempt transaction, and rank the gaps by exposure so remediation goes where it matters.