A ZATCA audit is not a surprise inspection with arbitrary powers. It operates within a defined legal framework — specific notice requirements, specific access rights, specific obligations on the business. Understanding that framework before an audit arrives is the difference between a managed process and an uncontrolled one.
The Legal Basis for Examinations
Article 64(6) of the VAT Implementing Regulations governs the conditions under which ZATCA conducts examinations. The article imposes obligations on both the authority and the taxable person — creating a structured framework that must be followed by both sides.
The starting point: taxable persons are obligated to cooperate with any examination carried out by ZATCA. This is not optional, and refusal to cooperate is itself a basis for ZATCA to conduct an unannounced visit.
The Notice Requirement — and When It Doesn’t Apply
The standard rule: ZATCA must issue notice twenty (20) days before the first date of the examination. The examination may be conducted at the taxable person’s premises or at ZATCA’s own premises.
The exception: ZATCA may conduct an examination without prior notice in either of these circumstances:
- ZATCA has good reason to suspect a violation of the Law or Regulations
- A refusal to cooperate by the taxable person has occurred or is likely to occur
The without-notice power is not unlimited — it requires ZATCA to have good reason to suspect a violation, not merely to prefer a surprise visit. But the threshold for “good reason” is determined by ZATCA, and businesses that have been flagged through risk-based scoring or third-party data signals are more likely to face unannounced examinations.
Under Article 56, ZATCA has the right to obtain information from third parties — including government entities, banks, and financial institutions regulated by SAMA or the Capital Market Authority. Banks cannot withhold account information on ZATCA’s request. This means ZATCA can cross-reference a business’s bank statements, payment records, and financial flows against declared VAT returns before ever arriving for an examination. The audit often starts well before the business knows it is being reviewed.
During the Examination: Rights and Obligations
Once an examination begins at the business’s premises, Article 64(6) sets the operational conditions:
- The examination is conducted during the taxable person’s working hours
- The taxable person must make available all invoices, books, records, and accounting documents required to be kept under the Law and Regulations
- Documents may be examined on or off the premises
- Where records are kept electronically, the taxable person must provide physical copies or electronic files on ZATCA’s request
- ZATCA employees may visit any premises of the taxable person to verify compliance
Where a taxable person fails to cooperate fully, ZATCA may take additional measures to obtain records — and may temporarily seize documents if it has reason to believe they may be hidden, damaged, or tampered with. Where a violation is suspected, ZATCA may conduct a search and collect evidence.
Document Return After Examination
Article 64(6)(e) provides that ZATCA must return any transferred documents to the taxable person within twenty (20) days from the end of the examination — unless ZATCA retains copies, which it may do where necessary.
What Triggers a ZATCA Audit
ZATCA does not publish its audit selection criteria, but the following patterns are known to elevate audit risk:
| Risk Factor | Why It Attracts Attention |
|---|---|
| Persistent VAT refund positions | Large or regular refund claims are scrutinised under the new Article 69(7) one-year audit window |
| Inconsistency between return data and third-party information | Bank data, supplier reporting, and e-invoicing data create cross-reference points ZATCA can compare against filed returns |
| Missing or late returns | Non-filers attract best-estimate assessments and follow-up examinations |
| Significant changes in reported figures across periods | Unusual spikes or drops in output or input tax without obvious explanation raise risk flags |
| Sectors with historically high compliance issues | Construction, real estate, financial services, and cross-border service businesses are frequently selected |
| E-invoicing data mismatches | Phase 2 e-invoicing integration gives ZATCA real-time invoice data to compare against return figures |
How to Prepare — Before the Notice Arrives
- Maintain a complete, accessible document archive. Six-year minimum retention, all records in Arabic, electronically accessible on demand — as required by Article 66.
- Reconcile e-invoice data against filed returns. ZATCA’s platform has your invoice data. Your returns must be reconcilable to that data. Any gap will be identified.
- Conduct a reverse charge completeness review. One of the most common audit findings is missing RCM output tax. A reconciliation of all foreign service invoices against declared RCM output tax should be a standard pre-audit exercise.
- Ensure proportional deduction calculations are documented. For businesses with exempt supplies, the partial exemption methodology must be defensible and applied consistently.
- Identify and correct known errors voluntarily. Voluntary correction before audit identification is treated more favourably under ZATCA’s penalty framework. Waiting for ZATCA to find an error that is already known internally is the costliest approach.
- ZATCA must give 20 days’ notice before examining a business at its premises — except where it has good reason to suspect a violation or expects non-cooperation.
- Taxpayers are legally obligated to cooperate with ZATCA examinations and must make all records available on request.
- ZATCA has broad third-party information access — including bank records and financial institution data — that it can use to cross-reference declared returns before arriving for examination.
- ZATCA may temporarily seize documents where it suspects they may be hidden, damaged, or tampered with. Seized documents must be returned within 20 days of examination completion.
- Submitting a refund claim now triggers a specific one-year audit window for that period under Article 69(7).
- e-Invoicing Phase 2 gives ZATCA near-real-time invoice data — making return-to-invoice reconciliation a standard audit tool.
- Voluntary correction before audit detection is treated more favourably than assessed errors. The best audit preparation is having nothing material left to find.
This article is for informational purposes only and does not constitute legal or tax advice. Regulations referenced are based on ZATCA publications current at time of writing. Always verify with a qualified Saudi tax professional for your specific circumstances.