What Triggers a KRA Audit — and What to Do When the Letter Comes

The most useful thing to understand about KRA audits is that they are not random. Cases are picked because the data KRA already holds — eTIMS invoices, withholding certificates, customs records, your own filing history — tells a story that does not add up. Which means most audits are predictable, and many are preventable.

What puts a business on the list

• Data mismatches: your declared sales don't match the eTIMS invoices your customers claimed, or withholding certificates issued against your PIN never appear in your return. This is the number one modern trigger.
• VAT refund claims: every significant refund claim is verified — a refund application is effectively an audit invitation you have signed.
• Perpetual losses or nil returns: a business that visibly trades but files losses or nils year after year invites the question of what it lives on.
• Margins far off your sector: a restaurant declaring 2% margins in a 15% industry stands out in KRA's analytics.
• Repeatedly amended returns and an erratic filing and payment history.
• Lifestyle gaps: assets and spending that a declared income could not fund.
• Third party information: complaints, suppliers' filings and other agencies' records.

KRA can generally look back up to five years — and further where fraud or wilful neglect is suspected — so the records you keep today are your defence file for 2031.

What an audit actually looks like

1. The letter. A notification stating which tax heads and which periods are under review. Read the scope carefully — it defines the whole exercise.
2. Document requests. Bank statements, invoices, ledgers, contracts, payroll records for the named periods. Larger cases add a field visit.
3. Findings and assessment. KRA sets out what it believes you owe. If you have not engaged, the figures will be estimates — built from their data, not yours, and rarely in your favour.

When the letter comes: six rules

1. Never ignore it. Silence converts KRA's estimate into a confirmed debt with penalties and interest running.
2. Confirm the scope — tax heads and periods — and supply what is asked for, not your entire history.
3. Assemble your records before responding. This is where a reconciled business shines: till statements matching eTIMS matching bank deposits, as set out in our records guide, close most queries at the first reply.
4. Get representation early. An accountant or tax agent who has handled audits knows what each request is really testing.
5. Never alter or backdate documents. An honest gap is a negotiation; a doctored record is an offence.
6. Meet every deadline in the letter — extensions are asked for in writing, in advance.

The audit you never get

Prevention is unglamorous: reconcile monthly, file every return on time — the compliance calendar is the checklist — keep records at least five years and make sure your eTIMS story, your bank story and your returns are one story. A business that would pass an audit tomorrow almost never gets one.