You received a ZATCA audit notice, or you can see one coming. A ZATCA audit notice often arrives with little warning, and what you do in the first week shapes everything after. The good news: a ZATCA tax audit is a structured process with defined stages, and most findings come from records that do not reconcile with each other, not from fraud. Companies that know the process respond on time, keep the scope contained and protect their rights. Companies that do not know it panic, overshare, and miss deadlines. This post walks through the process stage by stage, shows what auditors look at first, and explains what you can do if you disagree with the result.
Last reviewed: October 2026
Key points
- A ZATCA audit is a staged process: notice, document submission, review, preliminary findings, then final assessment.
- The notice defines the tax type, period and documents. The scope is your boundary, so assign one coordinator.
- Respond to preliminary findings with documents. It is the cheapest point to fix errors.
- Object to ZATCA within 60 days of the assessment. ZATCA has 90 days to decide, then you have 30 days to go to the GSTC.
1Why ZATCA selects a company for audit
ZATCA runs a risk-based selection system. Its systems compare what you declared across returns, invoices, customs records and e-invoicing data, and flag the differences. Based on professional guidance and ZATCA practice, the typical triggers look like this:
- VAT returns that do not match e-invoice (FATOORA) data or the general ledger.
- Large or repeated VAT refund claims.
- Gaps between customs import data and declared purchases or input VAT.
- Zakat and VAT figures that move in opposite directions without explanation.
- Related-party transactions without documentation.
No official trigger list is published, and ZATCA does not confirm why any specific taxpayer was selected. Treat the list above as the patterns practitioners see, not as a rulebook. The practical lesson is the same either way: the fastest route into an audit is data that does not agree with itself. ZATCA’s own e-invoicing programme is built around exactly this kind of data matching, which is why invoice-level discrepancies surface faster now than they did a few years ago.
2ZATCA tax audit types: desk audit vs field audit
A desk audit happens without a site visit. ZATCA sends an information request through the portal, you upload documents, and the auditor reviews them remotely. Many audits begin as desk audits.
A field audit means auditors come to your premises. They will ask for a working space, access to your accounting system, and the same documents a desk audit would request, but with follow-up questions on the spot. ZATCA generally gives advance notice before examining premises, commonly cited as 20 days, so check your notice for the date. Field audits are more common for larger taxpayers, for sectors ZATCA is focusing on, or when a desk audit raised questions that documents alone could not answer.
Know which one you are in, because it changes the logistics. In a field audit, control who talks to the auditor. One named coordinator, answers in writing, everything logged.
3The ZATCA audit process, step by step
The ZATCA audit process follows one sequence, whether the audit is desk or field. Knowing the stages turns the notice into a schedule:
- Notice and information request. ZATCA notifies you and specifies the tax type, the period under audit, and the documents required. The tax audit notice defines the scope, and the scope is your boundary.
- Document submission. You upload or hand over the requested records within the window given in the request.
- Auditor review and questions. The auditor reconciles your returns to your ledgers and invoices, and asks follow-up questions. Answer in writing, and keep copies of everything you send.
- Preliminary findings. Before any final assessment, you get the findings and the chance to respond, correct the record, and provide missing documents.
- Final assessment notice. If the auditor maintains the findings, ZATCA issues a ZATCA assessment with the additional zakat or tax, and any penalties.
The response windows are stated in each request, and they vary. Check the actual notice rather than relying on a number you read somewhere, and never let a window lapse while an extension request is pending.
| Stage | What happens | Your move |
|---|---|---|
| Notice and information request | ZATCA defines the tax type, period and documents | Read the scope, assign one coordinator, calendar the deadline |
| Document submission | You upload the requested records | Submit indexed, complete, through one person |
| Review and questions | Auditor reconciles returns to records and asks follow-ups | Answer in writing, attach evidence, log everything |
| Preliminary findings | Findings shared before any assessment | Respond with documents; this is the cheapest point to fix errors |
| Final assessment | Assessment issued with additional amounts and penalties | Check the calculation, then pay or object within 60 days |
4What happens after the final assessment
If the audit ends with an assessment, two clocks start. The first is the objection clock: you generally have 60 days to object to ZATCA itself. ZATCA then has 90 days to decide. If you are still not satisfied, you have a further 30 days to request internal settlement or to file the case with the General Secretariat of the Tax Committees (GSTC), after which it goes to the First Instance and Appeals committees. The second is the payment clock: unpaid amounts start accumulating late payment penalties from their due date.
The two clocks interact, and this is where taxpayers lose the most value. A company that pays in full to “close the matter” may find the objection route harder to use for the amounts it has already accepted. A company that objects but pays nothing keeps its rights but accumulates penalties if the objection fails. The middle path many practitioners take: pay the undisputed portion, object to the disputed portion within the deadline, and note in the objection that the undisputed part is already settled. How payment and objection interact in your specific case is a legal question; confirm the current position under the Tax Procedures Law or with a licensed adviser before you pay anything you intend to dispute.
5What ZATCA auditors look at first in a tax audit
The first week of any audit is a reconciliation test. Expect the auditor to pull these four items before anything else:
- VAT returns against the general ledger and financial statements. The VAT reconciliation is the first working paper in every audit: the net VAT declared should match the VAT control account. If it does not, the auditor will want the explanation in writing.
- Input VAT against valid tax invoices. Every deducted riyal needs a compliant tax invoice behind it. Invoices missing the required fields are treated as if they do not exist.
- Zero-rated exports against export evidence. Customs declarations, shipping documents, proof the goods left the GCC. Zero-rating without evidence becomes a 15% standard-rated supply in the auditor’s working papers.
- Related-party transactions. Charges between group companies, loans from shareholders, management fees. The question is always the same: is the price at arm’s length, and where is the documentation?
Received an audit notice? The ZATCA Tax Audit Preparation & Dispute Resolution course shows you how to respond, step by step.
6Your rights during a ZATCA tax audit
An audit does not suspend your rights, and knowing them changes how the process feels. The objection and appeal framework comes from the tax laws and the procedures administered by the General Secretariat of the Zakat, Tax and Customs Committees:
- The right to know what is requested. The information request defines the scope. You are not obliged to dump your entire accounting system on the auditor because they asked informally.
- Reasonable time to respond. If the window is genuinely unworkable, request an extension in writing before it expires, with a reason and a date you can meet.
- The right to respond to preliminary findings. This is your single best chance to fix the outcome cheaply.
- The right to object. If you disagree with the final assessment, object to ZATCA itself within 60 days of notification. ZATCA has 90 days to decide, and you then have 30 days to request internal settlement or file with the GSTC, whose First Instance and Appeals committees hear the case.
The 60-day objection window is the deadline people miss. Once it passes, the assessment is likely to become final, and the conversation moves from tax technicalities to payment.
7Common mistakes during an audit
Sending documents in bulk without an index. A disorganised upload reads as a disorganised company. Number the request items, provide one folder per item, and put reconciliations on top.
Answering questions verbally without written follow-up. In a field audit, a casual corridor answer becomes part of the auditor’s working papers. Confirm anything you said in writing, with the documents attached.
Missing the objection deadline while waiting for a “settlement”. Informal conversations do not stop the 60-day clock. If you intend to object, file the objection; you can settle afterwards.
Paying an assessment without checking it. Paying stops the penalties from growing, but check the calculation first, and think about the objection route before you pay anything you dispute. If part of the assessment is clearly wrong, many practitioners pay the undisputed portion and object to the rest within the deadline. Get advice before you choose, not after.
Once the audit is behind you, the next protection is preparation: the ZATCA audit checklist lists the ten document groups to have ready before the next notice arrives.
8FAQ
How long does a ZATCA audit take?
A desk audit commonly closes within weeks; a field audit can run for months depending on the size of the company and the state of its records. The variable you control is how fast and how cleanly you produce documents. A company that answers an information request in one indexed submission usually finishes far earlier than one that sends documents in instalments.
What happens if I disagree with the assessment?
Submit an objection to ZATCA within 60 days of notification, attaching your evidence. ZATCA has 90 days to respond. If it rejects the objection or does not answer, you have 30 days to request internal settlement or file with the GSTC, and the case continues before the tax committees.
How much notice does ZATCA give before an audit?
The audit notice states the tax type, period and documents required. For examinations at your premises, ZATCA generally gives advance notice, commonly cited as 20 days. Always rely on the date in your actual notice.
What penalties can follow a ZATCA audit?
An assessment can add the unpaid zakat or tax, plus late payment and filing penalties. The amount depends on the tax type and the finding, so check the penalty basis in the assessment itself. See common VAT mistakes that lead to ZATCA penalties.
Does a ZATCA tax audit cover zakat and corporate income tax too?
Yes. An audit can cover VAT, zakat, corporate income tax and withholding tax, depending on the tax type named in the notice. Read the scope carefully, because it is your boundary.
How far back can ZATCA audit?
It depends on the limitation period for the tax type, and sources differ, so confirm it with the official law text or a licensed adviser. Keep records for at least six years, longer for capital assets.
Do I need a tax adviser for an audit?
Not always. For a small desk audit with clean records, a competent in-house response may be enough. For a field audit, large amounts, or anything involving related parties, professional representation usually pays for itself.
9Next step
You cannot control whether ZATCA audits you. You can control whether your VAT return reconciles to your ledger, whether your invoices are compliant, and whether your related-party files exist. Those three are the audit before the audit. If you want the full preparation method, the ZATCA Tax Audit Preparation & Dispute Resolution course covers response strategy, objections and dispute handling in detail.
Related reading: ZATCA audit checklist: 10 documents to prepare and zakat vs income tax in Saudi Arabia.
This article is general information, not legal or tax advice. Rules change; confirm with the official source or a licensed adviser.