Does a SARS verification mean I'm being audited?

No. A verification is a lighter check where SARS asks for documents to support the figures you declared. An audit is a deeper, more formal process that can run for months. Most small businesses receive verifications, not audits, and the letter states which one it is. Responding cleanly to a verification is the best way to stop it ever becoming an audit.

How long do I have to respond to a verification letter?

Usually around 21 business days from the date of the letter, submitted through eFiling. Don't leave it late — upload a complete, reconciled set of documents in one batch well before the cut-off. If you genuinely can't meet the deadline, engage with SARS to request more time rather than going silent, which triggers an estimated assessment.

What if I find a genuine mistake in my return while gathering documents?

Deal with it honestly. Depending on the situation you may be able to request a correction or disclose the error as part of your response, which can reduce any understatement penalty. Trying to hide it is far riskier — deliberate understatement can attract penalties of up to 200%. Speak to us and we'll advise the cleanest way to put it right.

How long do I need to keep my supporting records?

Five years from the date of submission of the relevant return. That covers the whole verification and audit window, which is exactly why businesses that file documents as they go sail through checks, while those that bin receipts get caught reconstructing a year from memory.

Got a SARS Verification Letter? Do This

A letter lands from SARS saying your return has been selected for verification, and your stomach drops. Deep breath. A verification is not an audit, it's not an accusation, and for a business with tidy records it's usually a non-event. It just means SARS wants to see the paperwork behind a number you declared. The businesses that get hurt aren't the ones that did something wrong — they're the ones that can't produce the evidence fast enough. Here's what's actually happening and exactly what to do.

Verification vs. audit — know the difference

A verification is SARS checking that what you declared matches your supporting documents. You upload the paperwork, they tick it off, done. An audit is a deeper, more formal examination that goes further into your affairs and can run for months. Most small businesses that get a letter are being verified, not audited. Read the letter carefully — it states which one it is, exactly what SARS wants, and the deadline. A verification handled cleanly almost never becomes an audit; a verification ignored is one of the surest ways to trigger one.

Do not ignore the letter. The single worst thing you can do is nothing. A verification you respond to cleanly closes in weeks. One you ignore escalates — into an estimated assessment SARS raises against you, penalties, interest, and a far bigger fight to unwind.

What usually triggers a verification

SARS runs on data now. It pulls third-party information from banks, employers, medical schemes, and others, and cross-checks it against your return automatically. A verification is often just the system flagging a mismatch or a number that looks unusual against its own records. Common triggers:

A VAT refund — refunds are checked more closely as a matter of course, and that's normal, not suspicious.
Figures that don't reconcile to the third-party data SARS already holds on you.
Big swings year on year, or deductions that look large relative to your declared income.
Round numbers and estimates where SARS expects precise, invoice-backed figures.
New registrations and first-time claims, which naturally attract more scrutiny.
Plain random selection — sometimes it genuinely is just your turn.

None of these mean you've done anything wrong. They mean SARS wants to see the evidence — and if you have it, you win.

What they'll ask for

Depending on the return, expect requests for invoices (issued and received), bank statements, contracts, proof of expenses claimed, VAT records, payroll records (IRP5s, EMP501 reconciliations), or logbooks for vehicle claims. The pattern never changes: prove the number. If you claimed R80,000 of repairs, SARS wants the invoices that add up to R80,000 — not a summary, the actual documents. This is why a valid tax invoice, not just a card slip, matters for every VAT claim.

5 years

How long you must keep supporting records — and the exact reason verifications are painless when you have

The timeline — usually 21 business days

The letter gives you a window to submit documents — typically around 21 business days via eFiling. Don't sit on it. Once you've uploaded everything, SARS reviews it and either accepts your return as filed — you get a completion letter and it's over — or raises a revised assessment. If the assessment goes against you and you disagree, you can lodge an objection, but that's a slower, more formal road. The whole thing resolves far faster when your documents are complete, reconciled and organised the first time, in one batch.

What happens if you get it wrong: understatement penalties

If a verification (or an audit) finds you actually understated your tax, SARS can add an understatement penalty on top of the tax and interest. The percentage scales with behaviour — from a lower charge where you simply didn't take reasonable care, up towards 200% for deliberate evasion. The lesson isn't to fear the process; it's that clean, honest records keep you at the bottom of that scale (or off it entirely), while a shoebox and a guess push you up it.

How to handle it — step by step

Read the letter properly. Note exactly what's requested and the deadline.
Pull the supporting documents together — invoices, statements, contracts, whatever backs the flagged figures.
Check they actually reconcile to what you declared. If there's a genuine error, deal with it honestly rather than hoping it slides past.
Upload everything through eFiling in one clean, well-labelled batch. Don't dribble it in over days.
Keep copies of what you sent and all SARS correspondence.
If anything is complex, missing, or the numbers don't tie out — get us involved before you respond, not after.

Worked example

The tidy business vs. the shoebox

Two businesses get the same VAT verification, 21 business days to respond. The first keeps every invoice in cloud accounting; the owner exports the lot, reconciles it to the VAT201, uploads it in an afternoon — and the refund is paid the following week. The second is reconstructing a year of receipts from a carrier bag, misses the deadline, gets an estimated assessment that ignores half their input VAT, and spends the next two months objecting to claw it back. Same letter. Completely different experience. The only difference was bookkeeping done as they went.

What happens after you've responded

Once your documents are in, one of two things follows. If SARS is satisfied, you get a completion letter confirming the verification is finalised and — where a refund was involved — releasing it. If SARS disagrees with a figure, it issues an additional or revised assessment setting out the change. That's not the end of the road: you have the right to lodge an objection (and, if that fails, an appeal) within the SARS timeframes, provided you have grounds and evidence. But an objection is a slower, more formal process than a verification, which is precisely why getting the documents right the first time is worth the effort — you'd much rather close it at the verification stage than fight an assessment afterwards.

The real lesson

A verification is only stressful if your records are a mess. Keep clean, contemporaneous books — ideally in cloud software that stores the source documents against every transaction — and it's an afternoon's admin, not a crisis. The businesses that breeze through are simply the ones that never let a receipt go unfiled. If you're staring at a letter right now, or you'd rather never have to scramble like this, talk to us. We handle SARS correspondence all the time, and we'll either deal with this one for you or make sure the next one is a non-event.

Got a SARS verification letter? Don't panic — do this