What an audit notice from an unregistered state actually is
At TaxCloud, we see the same triage failure repeatedly. A controller forwards a state letter asking how to size the assessment, and the document is a nexus questionnaire with no number on it and a 30-day information-gathering window. Or the reverse: a Notice of Determination with a six-figure proposed liability sits in the inbox while finance debates whether the state could really claim that much. The two open different options on different clocks. The first triage question isn't "how much do we owe." It's "what is this document."
Four documents arrive from state revenue departments after they decide an unregistered seller has nexus. Each carries a different legal weight and a different response posture.
| Document | What it is | Typical window | Authority |
|---|---|---|---|
| Nexus questionnaire | Pre-audit information request | About 30 days from the letter date | State administrative practice |
| Registration demand | Directive to register after a positive nexus determination | About 30 to 60 days | State-specific administrative practice |
| Notice of Determination | Formal proposed assessment with stated liability | Statutory protest window, often 30 to 90 days | |
| Field audit notice | Formal examination proceeding | State-specific examination timeline | State statutory examination authority |
The nexus questionnaire is the lightest of the four. The state suspects nexus and is asking for the facts.
The registration demand follows a positive nexus determination. The state has concluded nexus exists and is asking the brand to register. The window is shorter than the questionnaire, and the protest grounds are narrower.
The Notice of Determination most commonly arrives at a $20-80M Shopify or Shopify Plus brand the state has been tracking through 1099-K and marketplace-facilitator data without the brand ever filing. The state has skipped the questionnaire stage, computed an assessment from best-information-available data (Cal. Rev. & Tax. Code §6481; NY Tax Law §1138(a)(1); Tex. Tax Code §111.008), and issued the proposed liability with a statutory appeal window. Brands that misread this as another inquiry and try to address it informally waste the protest clock.
A field audit notice opens a formal examination proceeding with statutory authority behind it. Audit notices require outside counsel from day one and follow a separate response track. The deadline math and document preservation rules in the next section apply equally to all four; the resource deployment differs by document type.
The first 72 hours: triage, deadline, and document preservation
The cadence inside the first three days determines the rest of the engagement. Brands that calendar the deadline on day one and engage counsel before day three typically resolve the matter on the original deadline. Brands that wait for "more information" or "internal review" lose response options as the window closes around them.
Day 1: classify the document and calendar the deadline
Identify which of the four document types arrived. Read the procedural rights statement on the notice (every state-issued notice includes one). Compute the deadline from the notice date, not the receipt date. USPS delivery to a corporate office runs three to seven business days, so a 30-day window is often 23 to 27 days from when the envelope landed. Mark both dates on a shared calendar.
Day 1: preserve the original notice with the envelope
The envelope and postmark are evidence in any dispute about when the deadline began. Do not discard. Scan or photograph the front and back of the envelope before filing the document, and store the physical copy with the response package.
Day 2 to 3: engage tax counsel before any response leaves the building
The protest filing, the VDA evaluation, and the contest-versus-register decision are all CPA or tax attorney workflows. A Notice of Determination is a statutory appeal proceeding, not customer-service correspondence. The drafting of the protest letter, the legal theory presented, and the documentation chain attached to it are the work product the engagement produces. Engaging counsel by day three preserves the 27-plus days the protest letter needs to be built.
Day 2 to 3: stand up the prospective filing chain
Defensive registration in the assessed state means collecting and remitting from the registration date forward, separate from how the historical period resolves. The decision to defensively register or contest is the following section's conversation, but the operational requirement is the same in both branches: new exposure has to stop accumulating while the assessment is negotiated. TaxCloud handles the prospective chain through native Shopify, Shopify Plus, and BigCommerce integration and Certified Service Provider (CSP) filing infrastructure, so the brand can close new exposure on day three without waiting for the resolution path to set.
Voluntary disclosure eligibility after the state makes contact
By the time an audit or assessment notice has arrived, the voluntary disclosure agreement (VDA) path is usually closed for that state, for that tax type, for the period the notice covers. State VDA programs are structured around a "no prior contact" requirement, and the audit notice itself constitutes the disqualifying contact. Brands that hoped to VDA their way out of multi-state exposure have to pivot to contesting the nexus position, negotiating the assessment, or defensively registering and litigating the historical periods. Knowing VDA is off the table on day one stops a wasted application and frees counsel to focus on the live paths.
The "no prior contact" rule is consistent across the three programs that matter most for ecommerce brands in this position.
Multistate Tax Commission (MTC) Joint Voluntary Disclosure Program
The MTC program disqualifies any taxpayer that has received written contact from the state about the tax type and period at issue. [4] A Notice of Determination, a nexus questionnaire, and a registration demand all count as contact. The MTC program covers up to 37 participating states through a single anonymous application, so contact in one MTC state does not disqualify the brand from VDA in another MTC state. The state where the notice landed is out.
California's CDTFA Voluntary Disclosure Program
California's program disqualifies taxpayers that have received prior written contact regarding the tax obligation in question. [5] California interprets the contact rule narrowly relative to other states, but a Notice of Determination is unambiguous contact.
The Texas Comptroller Voluntary Disclosure Program
The Texas program disqualifies taxpayers under Comptroller administrative practice when the Comptroller has contacted the taxpayer about the tax type and periods at issue. [6] An assessment notice closes the Texas VDA path for those periods.
Two narrow paths remain.
First, the VDA path may still be open in states that have not yet made contact. A California Notice of Determination does not close the New York DTF VDA path[13], nor does it close the MTC program in any of the other 36 participating states. The audit notice is a signal to evaluate the uncontacted states quickly, because one state's enforcement activity often precedes other states' inquiries by 90 days or less (see What happens if you ignore a state sales tax notice for the cross-state cascade mechanics).
Second, certain general outreach (rate-change bulletins, mass educational mailings, generic registration reminders sent to every business in the state) may not constitute disqualifying contact under some state programs. The distinction is state-specific and narrow. Counsel makes the determination before assuming VDA remains available. A Notice of Determination is never general outreach.
The VDA evaluation closes inside the first week. After that, the conversation moves to defensive registration versus contesting the position, and the protest letter has to be drafted against the deadline that is already running.
Sizing the exposure inside the response deadline
The state has already done the exposure math, and it did it without the brand's help. The Notice of Determination is computed from best-information-available data (Cal. Rev. & Tax. Code §6481; NY Tax Law §1138(a)(1); Tex. Tax Code §111.008): 1099-K reports from Shopify Payments and Stripe, marketplace facilitator reports from Amazon and Walmart, federal partnership and S-corp pass-through data shared under IRC §6103(d), and freight or 3PL records. [1][2][3][7] The state applies its blended state and local rate to that gross figure, with no exemption for non-taxable categories, no offset for marketplace-collected sales, and no credit for tax already paid in other jurisdictions. The number is high by design.
The brand's exposure-scoping work, run inside the response deadline, builds the alternative number counsel brings to the negotiation. The same data sources the state used are available to the brand, with one critical advantage: the brand can apply taxability, marketplace offsets, and exemptions correctly.
Four data pulls cover most of what the scoping requires.
- Shopify state-level tax or order exports by period. Group by ship-to state and the measurement period the state uses (calendar year, rolling 12 months, or four sales-tax quarters). Cross-reference against the state's measurement basis: Texas counts total Texas revenue including exempt sales (Tex. Tax Code §151.107)[3], Washington counts cumulative gross receipts including facilitated and exempt sales (RCW 82.08.052)[8], and California counts gross sales of tangible personal property including sales by related persons under IRC §267(b) (Cal. Rev. & Tax. Code §6203). [9] A single $100,000 figure means different things across states.
- Marketplace settlement reports by state. Amazon Seller Central, Walmart Marketplace, and TikTok Shop reports show the volume the marketplace facilitator collected and remitted on the brand's behalf. In most states, marketplace-collected sales offset the brand's remittance liability even when they count toward the nexus threshold. Pulling the offset state by state is the single largest exposure reduction relative to the state's best-information-available number.
- Taxability mapping by product category. The brand's catalog mapped against each state's rules: apparel exempt in New York, Pennsylvania, and Minnesota; food taxable in some states and exempt in others. The taxable-mix percentage shifts the exposure estimate more than any other variable, and the state's calculation ignores it entirely.
- Blended rate by state. Sales-weighted average of state plus local rates across the brand's actual ship-to ZIP codes. Chicago's combined rate is 10.25% against Illinois' 6.25% state rate; Denver's is 8.81% against Colorado's 2.9%. Actual rate exposure may be higher than the state's calculation if volume concentrates in high-rate metros, or lower if it does not.
For brands running compliance through TaxCloud, the reporting API surfaces transaction logs by period and jurisdiction for any date range the state has opened, giving counsel a source-consistent base for the alternative exposure number without manual reconstruction from order management and accounting systems.
For the audit-response timeline, the exposure number lives in the protest letter and in the VDA-eligible-states queue: it is the figure counsel uses to challenge the state's best-information-available number, and the figure that ranks the rest of the unaddressed states by priority.
Defensive registration versus contesting the nexus position
The decision between defensive registration and contesting the underlying nexus determination turns on the strength of the nexus position. The shorthand: if the brand clearly had nexus, defensive registration plus lookback negotiation beats contesting. If the nexus basis is genuinely arguable, contesting can be worth the legal cost.
Defensive registration plus lookback negotiation
When the underlying nexus position is clear (in-state inventory at a third-party warehouse or 3PL, in-state employees, or an unambiguous threshold crossing supported by the brand's own sales data), the path of least resistance is to register from a defensible effective date, file back returns for the open lookback, and negotiate penalty abatement and lookback scope through the informal protest channel. The state already has the assessment number; the brand brings the corrected number, the marketplace offsets, and the taxability map, and the negotiation reduces the assessment to the defensible figure plus interest, with the penalty contested on reasonable-cause grounds.
This path resolves faster, costs less, and carries less risk than litigating. Legal costs typically run $25,000 to $75,000 across the informal protest. The brand exits with a final assessment, a clean registration record going forward, and no continuing nexus dispute.
Contesting the nexus position
The contest path applies when the nexus basis is arguable. Two patterns recur.
FBA-only inventory placement. For brands selling through Amazon FBA without in-state inventory under their direct control, the Pennsylvania Commonwealth Court's ruling in Online Merchants Guild v. Hassell (Pa. Cmwlth. Ct. 2022) [10] held that FBA inventory placed by Amazon without seller direction does not create physical nexus. California has historically taken the opposite position, but Hassell is persuasive authority a brand can cite in contesting an FBA-only nexus assertion. The position is state-specific and unsettled outside Pennsylvania.
Marketplace-facilitated volume that should not count toward the seller's liability. California's CDTFA Special Notice L-805 on the Marketplace Facilitator Act, effective October 1, 2019, clarifies that marketplace-facilitated sales are the marketplace facilitator's responsibility for collection and remittance. [11] A brand whose California volume runs primarily through Amazon and Walmart can contest the assessed liability on the ground that the marketplace facilitator already carries the obligation for that volume, reducing or eliminating the seller's exposure even where the marketplace volume counts toward the $500,000 threshold (Cal. Rev. & Tax. Code §6203). Texas treats marketplace-facilitated sales differently for threshold-counting purposes (Tex. Tax Code §151.107; Texas Comptroller Publication 94-108, "Engaged in Business"), and the per-state measurement basis governs which volume counts. [3][12]
Contesting is appropriate when one of these patterns applies and the brand has the documentation to support the position. Legal costs run higher ($50,000 to $200,000 across formal administrative protest or tax court), and the timeline extends to 12 to 36 months. The upside if the contest succeeds is the full assessment vacated, the penalty waived, and precedential value for future audits.
| Path | When to use | Typical legal cost | Timeline | Outcome shape |
|---|---|---|---|---|
| Defensive registration + lookback negotiation | Nexus clearly existed; in-state inventory, employees, or unambiguous threshold crossing | $25,000 to $75,000 | 6 to 18 months | Reduced assessment, penalty abatement, clean prospective registration |
| Contest nexus position | Arguable nexus basis: FBA-only inventory, marketplace-facilitated volume that should not count | $50,000 to $200,000+ | 12 to 36 months | Full assessment vacated if successful; same liability plus legal cost if not |
The decision lives with counsel, but the brand's role is the documentation that supports either path: physical-footprint timeline by state, FBA inventory placement records from Amazon, marketplace settlement reports showing the facilitator-collected portion, and the brand's nexus analysis with dates.
The operating model after resolution
The protest closes. The assessment is paid or vacated. The brand is now registered in the affected state, and the question shifts. The audit-response work was a CPA or tax attorney engagement on a fixed deadline. The operating model after the assessment resolves is the sustained compliance program: registration, calculation at checkout, consolidated filing across the brand's full footprint, and the documentation trail that defends the next audit.
The post-resolution check is the same set of questions the audit-committee posture frames quarterly. Are all states with confirmed nexus registered. Is the prospective filing chain live for each. Is the source documentation accessible without manual reconstruction. Is the next audit's evidence base being built every day of operation, or only when the next notice arrives.
For brands with a multi-state footprint that includes Streamlined Sales Tax (SST) member states, the post-resolution registration apparatus is different across the 24 participating states than across the rest. SST registration through a Certified Service Provider gives the brand one consolidated filing covering 24 states instead of 24 separate filings, with no filing cost in those states; the rest of the footprint runs as direct state-by-state filing. For a brand registered in 30 states, that is one consolidated SST filing covering 24 plus six direct filings for the rest, not 30 separate filings.
The reader here is past the triage and past the contest-versus-register decision. The question is what the operating model looks like once the assessment closes and the brand is registered across the full nexus footprint. TaxCloud is built for that: registration across confirmed-nexus states, native Shopify, Shopify Plus, BigCommerce, and QuickBooks Online integration, consolidated SST filing across the 24 member states, and the documentation trail through the reporting API that supports both post-assessment audit defense and the next-cycle compliance program.