The exempt-sale review: what auditors are actually testing
Exempt-sale testing is where audits often get expensive quickly. The certificates may exist, but if the seller cannot tie them to the sampled transactions, the auditor usually treats those sales as unsupported. The request is straightforward: produce the certificate behind each sampled exempt sale and show that it matches the transaction by purchaser, date, and exemption basis.
The review usually unfolds in three steps.
First, the auditor selects a sample from the exempt-sales population for the audit period. Depending on the state and the volume involved, that may be a block sample from one part of the period or a statistical sample across the full population. [3][8]
Second, the auditor tests the certificate tied to each sampled transaction against the ship-to state’s rules. The pass-fail factors are usually the same: accepted form, completed required fields, valid registration number or other accepted identification, signature, date, and a plausible exempt purpose. [1][5][6]
Third, the auditor projects the sampled failure rate across the broader exempt-sales population. That is why exempt-sales documentation becomes a system issue rather than a paperwork issue. A modest number of failures in the sample can become a much larger assessed amount after extrapolation.
The validity test: what makes a certificate hold up
The validity test is mechanical. If the certificate uses the wrong form for the state, is missing required fields, carries an unresolved registration number, or cannot be tied to a credible exempt purpose, it usually fails.
The state-specific details vary, but the operational pattern is similar:
| State group | Required elements | Common accepted forms | Source |
|---|---|---|---|
| California | Purchaser identity, seller’s permit number, property description, resale or exempt purpose, signature, date | CDTFA-230 and state-specific variants depending on exemption type | Cal. Code Regs. tit. 18, section 1668.[1] |
| New York | Purchaser identity, Certificate of Authority number, property description, exemption reason, signature, date | ST-120, ST-121, ST-119.1, and related state forms | New York Publication 750.[5] |
| Texas | Purchaser identity, permit or out-of-state registration number, property description, exemption reason, certification statement, signature, date | Form 01-339 | 34 Tex. Admin. Code section 3.287.[6] |
| Streamlined states | Purchaser identity, identification number, exemption reason, business type, signature, date | SST Certificate of Exemption, Form F0003 |
Good-faith acceptance sits alongside the form test. In general, a seller that accepts a properly completed certificate in good faith is relieved of the burden of proving the sale was exempt, but good faith requires more than a filled form. The certificate still has to fit the transaction and the purchaser’s business profile. [1][5][6]
Registration-number validation is one of the most common failure points. If the number on the certificate does not resolve on the state’s lookup or does not align with the purchaser shown on the form, the auditor will often treat the certificate as absent. That is why state-lookup validation at the time of collection matters more than a visual review years later.
How auditors sample exempt sales
Sampling is what makes certificate failures scale into a meaningful assessment. Most states do not test every certificate in a large exempt-sales population. Instead, the auditor tests a sample and projects the resulting error rate.
Two methods are common.
Block sampling
The auditor reviews every exempt sale in a defined slice of the audit period, such as one quarter or one year. This is common for smaller populations or when the seller’s systems do not support reliable random sampling. [3][8]
Statistical sampling
The auditor selects a random sample sized to a stated confidence level and then projects the sampled error rate across the broader population. This is more common for high-volume exempt-sales books where testing every certificate in period is not practical. [3][8]
The extrapolation effect is the key point. If a seller has $5 million of exempt sales in scope and the auditor finds a 10% unsupported rate in the sample, the state may treat $500,000 of the population as misclassified taxable sales before penalty and interest are added. The danger is the projected error rate, not just the sampled transactions themselves.
When a missing or invalid certificate becomes a tax assessment
A missing certificate is not just an incomplete file. In an audit, it is usually the trigger for a tax assessment.
The sequence is usually:
- Reclassification of the sampled sale. The sale is treated as taxable as of the original transaction date.
- Application of the historical rate. The state and local rate in effect when the sale occurred is used for the tax calculation.
- Penalty. State penalty rules apply once the tax is treated as underreported or unpaid. [2][7]
- Interest. Statutory interest usually runs from the original due date of the return that should have reported the tax. [2][7]
- Projection across the population. The same failure rate is often applied to the broader exempt-sales base, not only to the sampled items.
The SST agreement provides one limited form of structural relief. Section 317.A.4 allows liability relief where a fully completed exemption certificate is obtained within 90 days of the sale. Some Streamlined states also allow an audit-period cure window, but that is not uniform and should be treated as state-specific rather than automatic. [9]
How SST Form F0003 works across states
The SST Certificate of Exemption, Form F0003, is the closest thing to a multi-state standard, but it is not a universal substitute for state forms.
As of July 28, 2026, the Streamlined Sales Tax Governing Board lists 23 full member states and Tennessee as the only associate member state. Full member states accept the SST form under the agreement framework; major non-member states do not. [10][11]
That creates two operational groups:
| Treatment of F0003 | States | Operational consequence |
|---|---|---|
| Accepted under SST rules | Streamlined full member states | One properly completed SST form can support exempt transactions across the Streamlined footprint, subject to state-specific exemption rules. |
| Not accepted as a substitute for state forms | Non-member states such as California, New York, Florida, and Texas | The seller must collect the state-issued form required by that state. |
For large non-member states, the state form still governs:
- California: CDTFA-230 and related California forms depending on the exemption type. [1]
- New York: ST-120, ST-121, ST-119.1, and other New York forms depending on the exemption claimed. [5]
- Texas: Form 01-339 for resale and exemption claims. [6]
- Florida: Form DR-13, with Florida’s annual resale-certificate structure. [12]
The Multistate Tax Commission resale certificate is a separate tool for resale transactions in participating states, but it is narrower than the SST form because it focuses on resale rather than the full set of exemption-use scenarios. [13]
The practical audit consequence is straightforward: if the seller collected only F0003 across all states, the cert pool will usually fail structurally in the non-SST footprint, no matter how disciplined the collection process looked internally.
Building the evidence chain before the notice arrives
The sellers that hold up best in this review are the ones that built the linkage before the audit started. Every exempt transaction can be matched to the certificate that covered that buyer in that state at that time.
At an operational level, that usually means four things:
- Collection at onboarding or order time. The buyer is routed to the right state form for the ship-to state rather than a one-form-for-all-states shortcut.
- Validation at collection. Registration numbers and required fields are checked before the exempt sale is finalized.
- Transaction-to-certificate linkage. Each exempt order resolves to the certificate that supported it at the time of sale.
- Audit-ready export. When the sample arrives, the seller can pull one package keyed to the sampled transactions and produce the linked certificates quickly.
That is also the most useful place to mention a provider like TaxCloud: not as the answer to the legal standard, but as one implementation option for certificate collection, state-specific validation, and transaction-level linkage within an ongoing compliance workflow.