Pakistan Tax Audit Checklist: Get FBR Audit-Ready
What is an FBR Tax Audit?
An FBR audit is a formal review of your records against what you declared. For a sales-tax-registered business the auditor checks that:
- Sales declared in the monthly sales tax returns agree with the invoices issued, including the digital invoices recorded on IRIS
- Output tax was charged at the right rate (standard rate 18%, or the reduced, zero or exempt rate the schedule or SRO allows)
- Input tax claimed is supported by valid suppliers' invoices
- Sales tax withheld at source and income tax withheld were deducted, deposited and reported
- Turnover in the income tax return agrees with the sales tax returns and the invoices
Cases are selected through:
- FBR's audit selection process: risk-based or ballot selection announced by FBR
- Return inconsistencies: sales tax returns that do not agree with digital invoice data on IRIS, or with buyers' declarations
- Late or missing returns: gaps in monthly returns or withholding statements
- Sector focus: FBR attention on particular sectors from time to time
- Third-party information: data from banks, customs, buyers or suppliers that does not match your declarations
Being FBR audit-ready means you can produce every invoice, return and supporting document for the period within the time the notice allows.
The 15-Point FBR Audit Checklist
✅ Complete Audit Preparation Checklist
Every sales tax invoice for the period is present, with its FBR invoice number where the sale was digitally invoiced. Your own invoice sequence has no unexplained gaps; cancelled invoices are kept, not deleted.
Date, value, sales tax and buyer NTN (7 digits) or CNIC (13 digits) on each invoice agree with the record on IRIS. Any edit made under FBR's 72-hour rule is noted with the date and reason.
Twelve months of statements for every business account, filed by month. Receipts against invoices are identified so sales can be traced to deposits.
Every input tax claim is supported by a supplier's valid sales tax invoice showing the supplier's STRN. Check that suppliers were active taxpayers at the time of supply.
Opening stock plus purchases minus sales equals closing stock. Damaged, expired or returned goods are documented so the difference can be explained.
Every monthly return was filed by the 18th of the following month and the tax paid by the 15th. Supplies declared in the return agree with the invoices issued, and the digital invoices shown on IRIS.
Advance income tax instalments under section 147 of the Income Tax Ordinance 2001 were paid and the payment challans kept. Confirm the current due dates on fbr.gov.pk. The amounts are credited in the annual return.
Where you are a withholding agent, tax withheld from salaries, suppliers and services was deposited and the quarterly withholding statements were filed by the 20th of the month following the quarter. Sales tax withheld at source (1/5, 1/10 or full) is shown on the invoices where it applies.
Each buyer's registration type (Registered or Unregistered) was checked through FBR's registration service before invoicing, and further tax (4%) was charged on supplies to unregistered buyers where the law requires it.
If your business category is required to integrate under SRO 69(I)/2025 and the phased deadlines of SRO 709(I)/2025 and later FBR extensions, all sales invoices were issued through the integrated system and carry the FBR invoice number and QR code. Keep the IRIS enrolment record. Check the latest notification for your category.
The Sales Tax Act 1990 requires records to be kept for 6 years. Organise them by tax period so any year in that range can be produced.
Sales per invoices = sales per the monthly sales tax returns = turnover in the income tax return (due 30 September for individuals and AOPs, 31 December for companies). Differences such as cancelled invoices, debit notes and credit notes are listed and explained.
One audit file with an index: invoices, returns, challans, bank statements, purchase invoices and correspondence, in date order, each traceable to the other.
Edits and cancellations made on IRIS within 72 hours (or by month end), debit notes issued through the API within 180 days of the original invoice, credit notes raised on IRIS, and any Commissioner approvals are filed with the original invoice.
Companies whose accounts are audited keep the auditor's report and the audited financial statements with the income tax return; the auditor may refer to them.
Common Audit Findings (And How to Avoid Them)
Finding #1: Missing Invoices
Problem: "The auditor asked for June's invoices and we could only produce 80 of 120." Sales declared on the return cannot be tied to documents.
Prevention: Keep every invoice, including cancelled ones, in one system with its FBR invoice number. Check IRIS each month and confirm the invoices recorded there match your records.
Finding #2: Invoice and Receipt Mismatches
Problem: "The invoice value and the bank deposit differ." The auditor asks whether sales were under-declared.
Prevention: Record payments against each invoice (cheque number, bank, date, amount) so discounts, part payments and bank charges are explained at the time, not reconstructed later.
Finding #3: Wrong Sales Tax Rate
Problem: "We charged a reduced rate on goods that attract the standard rate of 18%." FBR assesses the short-paid tax with default surcharge and a penalty under section 33 of the Sales Tax Act 1990.
Prevention: Set the correct sale type for each product once, use the rate FBR returns for that sale type and date, and record the SRO schedule and item serial for every reduced-rate, zero-rated or exempt item.
Finding #4: Unexplained Stock Differences
Problem: "Purchases less sales do not equal the stock on hand." The auditor treats the gap as unrecorded sales.
Prevention: Count stock regularly and document damaged, expired and returned goods in writing when they occur.
Finding #5: Unsupported Input Tax
Problem: "Input tax was claimed on purchases without a valid supplier invoice." The claim is disallowed.
Prevention: Keep every supplier's sales tax invoice and confirm the supplier's registration status at the time of purchase.
Finding #6: Buyer Treated as Registered When Not
Problem: "The invoice shows the buyer as registered but FBR's record shows unregistered." Further tax was not charged and the digital invoice may have been rejected with error 0053.
Prevention: Check the registration type through FBR's registration service before invoicing and keep the customer record up to date.
Finding #7: Advance Tax Not Credited
Problem: "Advance tax was paid but not claimed in the income tax return." The return overstates the tax payable or the credit is lost.
Prevention: Keep the payment challans and enter every instalment in the annual return.
Finding #8: Late Filing
Problem: "The sales tax return went in after the 18th and the income tax return after the due date." Penalties apply under section 33 of the Sales Tax Act 1990 and the Income Tax Ordinance 2001, and late income tax filing can affect your Active Taxpayer List status.
Prevention: Diary the dates: sales tax return by the 18th of the following month (payment by the 15th), income tax return by 30 September for individuals and AOPs and 31 December for companies, withholding statements quarterly by the 20th of the following month. FBR announces any extension by notification.
How Audits Typically Proceed
Step 1: Audit Notice
FBR issues a written notice under section 25 of the Sales Tax Act 1990 or section 177 of the Income Tax Ordinance 2001 stating:
- The tax periods under audit
- The records and documents to produce
- The date by which they must be produced
Step 2: Production of Records
The auditor examines:
- Sales invoices and the digital invoices recorded on IRIS
- Purchase invoices supporting input tax
- Bank statements and payment records
- Stock records where relevant
- Returns, withholding statements and payment challans against the records
Step 3: Audit Observations
The auditor sets out the discrepancies found and the proposed adjustments. Where tax appears short-paid, a show-cause notice follows.
Step 4: Your Response
Within the time the notice allows you can:
- Accept the observations and pay the tax and default surcharge due
- Provide documents and explanations to rebut them
- Attend the hearing, in person or through your authorised representative
Step 5: Assessment Order and Appeal
FBR issues an order stating:
- Tax assessed (if any)
- Default surcharge and penalties (if any)
- The payment date
- Your right of appeal to the Commissioner (Appeals) within the statutory time
Audit-Ready Documentation Organization
Create an "Audit File" Structured Like This:
- Folder: Sales Invoices (by month, with FBR invoice numbers; PDF copies of each invoice)
- Folder: Purchase Invoices (suppliers' sales tax invoices supporting input tax)
- Folder: Bank Statements (12 months, PDF copies)
- Folder: Stock Records (counts and write-off memos, where you hold stock)
- Folder: Returns and Challans (monthly sales tax returns, withholding statements, income tax return, advance tax challans)
- Folder: Buyer Verification (registration-type checks and customer records)
- Folder: Corrections, Debit and Credit Notes (IRIS edits and cancellations, debit notes, credit notes, Commissioner approvals)
- Index document: one list of what is in each folder and the periods covered
Copies: keep a second copy of the file away from the originals. Records must be available for 6 years.
Integrated Digital Invoicing vs. Other Records
For the business categories FBR has notified, integrated digital invoicing is a legal requirement, not a preference. Where you stand depends on your category and the latest FBR notification:
| Invoicing Method | Position | Audit Considerations |
|---|---|---|
| Integrated digital invoicing through the PRAL API | Required for notified categories; invoices are transmitted to FBR when issued and carry the FBR invoice number and QR code | FBR already holds the invoice data; your records must agree with IRIS |
| Non-integrated software | Acceptable only while your category is not yet required to integrate; check the latest notification | Sales must be reconciled to the return from your own records |
| Manual (hand-written) invoices | Same position as non-integrated software; not acceptable once your category is notified | Harder to reconcile; higher chance of arithmetic and rate errors |
| No invoices issued | Non-compliant for a registered person | Sales treated as unrecorded; penalties under section 33 |
Best practice: issue every sale through the integrated system once your category is notified, and keep the deadline for your category under review on the FBR Notifications page.
Prevention Strategies: Audit-Ready Year-Round
Don't wait for an audit notice. Implement these ongoing practices:
- Monthly reconciliation: agree invoices issued to the sales tax return and to the invoices shown on IRIS before the return is filed
- Regular stock counts: where you hold stock, count it and document differences as they arise
- Deadline check: sales tax return by the 18th, payment by the 15th, withholding statements quarterly by the 20th, income tax return by 30 September or 31 December
- Invoice review: sample invoices each month for rate, sale type, SRO fields and buyer registration type
- Buyer checks: re-check the registration type of regular buyers from time to time; status can change
- Second copy of records: keep an off-site or cloud copy of the audit file
- Quarterly self-audit: work through this checklist every quarter
Using FinSmart for Audit-Ready Records
FinSmart is FBR Digital Invoicing software, not an accounting or return-filing tool, but its records cover the invoice side of an audit:
- Submitted invoice records: every invoice with its FBR invoice number, QR code, buyer details, HS codes, rates and SRO fields; submitted production invoices cannot be edited or deleted, so the record matches what FBR received
- FBR audit logs: server-side logs of every request sent to FBR and every response received, including validation errors and timeouts
- Activity log: who created, updated or deleted what, and when, per business (kept for 90 days)
- Invoice numbering: financial-year based numbering with a prefix, start number and padding; numbers never change after creation, so gaps are visible
- Payments against invoices: cheque number, bank, dates and amount recorded per invoice, with unpaid, partially paid and paid status
- Dashboard: total invoiced and total tax for any week, month, year or custom date range, filtered by FBR status, to agree with the monthly return
- PDF download: each invoice as a PDF with the FBR logo, FBR invoice number and QR code for the audit file
FAQ: Tax Audits
Q: What should I do if I receive an audit notice?
A: Read the notice for the periods, documents and date. Assemble the records using this checklist. Involve your tax advisor early. Produce the records by the date given and answer questions with documents rather than from memory.
Q: Can I refuse an audit?
A: No. FBR has statutory authority to call for records and audit a registered person. Failing to produce records attracts penalties under section 33 of the Sales Tax Act 1990 and can lead to a best-judgement assessment.
Q: How long does an audit take?
A: There is no fixed duration. It depends on the periods under audit, the state of your records and the number of observations raised. Well-organised records shorten it.
Q: What if the auditor finds tax is short-paid?
A: FBR issues an assessment for the tax, default surcharge and any penalty under section 33. You can pay, or appeal to the Commissioner (Appeals) within the statutory time if you disagree.
Ready to Get Audit-Ready?
Being audit-ready means having every invoice, return and supporting record organised before an audit happens. Most difficulties in audits come from incomplete or disorganised records, not from tax that is actually owed.
FinSmart keeps the invoice side in order: every submitted invoice with its FBR invoice number, the FBR request and response logs, and the activity log, ready to be produced when needed.