How do sales tax audits work in an SST member state when you use a CSP?

In a Streamlined Sales Tax member state where you qualify as a CSP-compensated seller, the state puts its audit questions to your Certified Service Provider rather than to you, and the provider comes back to you for supporting documents. Where you do not qualify, the state contacts you directly. Either way, an audit still reaches everything your provider did not do.

Two things decide how an SST audit reaches you in a member state: whether you qualify as a CSP-compensated seller there, and whether the transactions in question are ones your provider processed.

Who does the state contact when you use a Certified Service Provider?

Your provider, and this is a rule the states bound themselves to rather than a courtesy. The Governing Board’s FAQs about Certified Service Providers put it directly: “During an audit of a CSP-compensated seller, the Streamlined Member States must go through the CSP to conduct the audit, rather than contacting the seller directly.”

In practice the sequence is that audit questions go to the provider, the provider works the ones it can answer from the data it holds, and it comes back to you only for documents it does not have. The stated intent is to cut the number of auditors arriving at your business.

The routing rule has a subject as well as a set of exceptions, and both matter. Its subject is the transactions your provider processed, so it isn’t a general shield around your business: on anything your provider never touched, a state deals with you the way it always would. Inside that subject, three things let a state come to you directly. It may answer a question you asked it, act where fraud is suspected, or come for information your provider genuinely cannot supply. None of the three is a loophole that returns you to ordinary audit exposure on your processed transactions, and none of them is theoretical either.

A Certified Automated System is treated differently. If you use a CAS rather than a provider, the state contacts you directly.

What is your provider paid to do in an audit, and where does that stop?

Responding to notices and audits, and producing the supporting documentation for them, is one of the services the member states fund where you qualify. It sits alongside setup, calculation, return preparation, filing, remittance, and protecting your tax data. So an audit of the work your provider did is work your provider is paid to handle.

The line runs around the work itself. Your provider answers for what it calculated, filed, and remitted. It doesn’t answer for a decision you made upstream of it, for a period before it started, or for tax on your own business purchases, which is excluded from the funded work by design.

One thing to check before you lean on it. The funded scope is the same whichever certified provider you use, because it comes from the same contract with the states. What each provider publishes about actually doing that work is not the same, and on notice and audit response the six run from a named service on the free list to nothing published at all. That is a question for the provider comparison rather than one this page can answer for you.

What does the CSP liability relief actually cover?

This is the part most descriptions get loose about, and the distinction that matters is whose data was wrong, not who made the error.

Table: what the Streamlined liability relief covers when a certified provider calculates your tax, and what it does not. Checked September 1, 2026.

What went wrong	Do you get liability relief?
The state’s rate file was wrong and your provider relied on it	Yes
The state’s boundary file or jurisdiction assignment was wrong	Yes
The library section of the state’s taxability matrix was wrong	Yes
The tax administration practices section of the state’s taxability matrix was wrong	Only to the extent that state’s law allows
The state certified your provider’s tax rules and they were wrong	Only to the extent that state’s law allows
Your product was mapped to the wrong category or tax rule	No
Tax on your own business purchases	No, and it was never in scope
Periods before your registration date	No. See amnesty for what does reach backwards

That sixth row is the one to read twice. The Governing Board is explicit: “You will not receive liability relief if you or the CSP incorrectly classify your product into an incorrect product category or to an incorrect tax rule.” Mapping your catalogue onto tax rules is the step where your business knowledge meets the tax engine, and it is exactly where a wrong answer is expensive. Nothing about that is softened by your provider’s contract: a provider carries mapping errors as between the two of you, and where you did the mapping it can bill you to fix them. That is a commercial arrangement, not liability relief from the state.

So the relief is real and it is narrow. It covers you for trusting the state. It doesn’t cover you for describing your own products wrongly.

What changes where you do not qualify as a CSP-compensated seller?

Two things change in a member state where you do not qualify, and they change only in that state.

The state contacts you directly, because the routing rule is written around CSP-compensated sellers rather than around providers. And the work stops being state funded, so your provider can bill you for it. Qualification is tested state by state, which means a business with a warehouse in one member state and nothing but sales in six others can be on both sides of this in the same year.

That is worth wiring into whoever approves a lease or a first hire in a new state, because the consequence lands months after the decision.

What stays yours in an audit whoever files your returns?

The records. The six services the states fund do not include holding your exemption certificates, your purchase invoices, or your ledger, so an audit that goes beyond calculation lands on records that are yours. Some providers sell certificate management separately.

Also yours: the accuracy of what you told the system your products are, tax on your own purchases, anything outside the member states, and any period before you registered. Your customers’ identities largely stay out of it, and that is a duty on the provider rather than a promise from the states. A certified provider has to certify that it keeps personally identifiable information only as far as documenting exempt sales and assigning the right jurisdiction requires, and the Governing Board describes calculation, remittance and reporting as running, with very limited exceptions, without retaining who your customers are.

How often do SST audits happen, and who decides what gets reviewed?

Two different things run under the word audit here, and only one of them is about you. The program runs its own compliance reviews of the certified providers, and each member state decides for itself which of a provider’s sellers to pull into one, and whether to look at everything or sample. Providers supply the states with a list of the sellers they process for and the date each one started, which is how a state knows whose transactions are in scope. A state auditing you specifically is the other thing, and it follows the contact rule: where you qualify as a CSP-compensated seller the state goes through your provider, and where you do not it comes to you directly.

There’s no published schedule, and nothing here is a prediction that you will or will not be audited. Using a certified provider changes who fields the questions and who carries the risk on the states’ own data. It doesn’t make an audit less likely, and no provider can promise otherwise.