How to Prepare for ZATCA Audits in Saudi Arabia 2026: Records, E‑invoicing Phase 2, Penalties & Response Timelines

Understanding how to prepare for ZATCA audits has become a front-burner priority for every finance and compliance team operating in Saudi Arabia. The Zakat, Tax and Customs Authority, known as ZATCA, has intensified its enforcement posture throughout 2026, driven by the continuing roll-out of e‑invoicing Phase 2 integration waves and the publication of updated E‑Invoicing Detailed Guidelines (FATOORAH). With successive taxpayer groups being onboarded to the FATOORA platform, auditors now have real-time visibility into invoicing data that was previously reconciled only at filing. This guide delivers the concrete records checklists, portal procedures, penalty matrices and response timelines that CFOs, internal auditors and compliance officers need to act on immediately.

Executive Summary: Why 2026 Is Different for ZATCA Audits

Three converging forces make the 2026 audit cycle materially more demanding than any that preceded it:

• Phase 2 integration waves continue to expand. ZATCA has published e‑invoicing requirements that are rolled out in successive waves under Phase 2, progressively pulling additional taxpayer groups into real-time integration with the FATOORA platform. Each new wave means another cohort of businesses must demonstrate system-level compliance during any audit.
• Updated Detailed Guidelines raise the evidence bar. ZATCA’s publication of updated E‑Invoicing Detailed Guidelines clarifies exactly which data fields, formats and validation rules auditors may scrutinise, and what constitutes non-compliance.
• Risk-engine-driven selection is maturing. Industry observers expect ZATCA’s risk engine to flag discrepancies between FATOORA payload data and VAT return figures faster than in prior cycles, in line with OECD best-practice models for risk-based audit selection.
• Immediate action required. Businesses that have not yet reconciled their ERP outputs against FATOORA submission logs, confirmed their ERAD portal credentials, or updated their record-retention policies should treat these tasks as urgent.

Quick Compliance Checklist: How to Prepare for ZATCA Audits at a Glance

Before diving into the detailed guidance below, use this ten-point checklist as an at-a-glance action list. Each item maps to a deeper section later in this article.

1. Confirm ZATCA registration status. Verify that your VAT, Zakat and excise registrations are current and that all amendments (address changes, branch additions) have been filed.
2. Validate ERAD portal credentials. Ensure that authorised users can log in to the ZATCA portal and access the FATOORA production environment without delay.
3. Complete FATOORA simulation testing. If your organisation has recently changed ERP systems or e‑invoicing solution providers, re-run the FATOORA simulation cycle to confirm payload acceptance.
4. Reconcile VAT returns to general ledger. Produce period-by-period reconciliations between filed VAT returns and the underlying sales and purchase ledgers.
5. Prepare Zakat computation working papers. Maintain audited financial statements and detailed schedules that reconcile accounting profit to the Zakat base.
6. Archive e‑invoicing payloads and API logs. Store all XML/UBL payloads, API call logs, clearance responses and QR code data in a secure, indexed repository.
7. Document internal controls. Compile evidence of segregation of duties, approval workflows and exception-handling procedures that govern invoice issuance and tax reporting.
8. Update excise tax schedules. If applicable, ensure excise declarations and supporting stock-movement records are current.
9. Train relevant staff. Brief finance, IT and procurement teams on what ZATCA auditors may request and how to respond to data-extraction demands.
10. Engage qualified legal or audit counsel. Complex exposures, transfer pricing, cross-border services, or prior-period adjustments, may require specialist advisory support.

Records to Keep: Precise Documentation for ZATCA Audits

Knowing how to prepare for ZATCA audits starts with assembling the right records. ZATCA’s e‑invoicing framework, together with existing Zakat and VAT regulations, creates a multi-layered documentation obligation. The following categories represent the core evidence set that auditors are likely to request.

Invoices and FATOORA payloads

• Original XML or UBL 2.1 invoice payloads submitted through the ZATCA FATOORA portal.
• ZATCA clearance or reporting responses (including invoice hash, cryptographic stamp and UUID).
• PDF representations generated for customers (B2C simplified invoices with QR codes; B2B standard invoices).
• Credit and debit note payloads linked to the original invoice reference.

Sales and purchase ledgers

• General-ledger transaction listings showing VAT output and input amounts by period.
• Aging schedules and write-off approvals that affect revenue recognition and VAT adjustments.

Bank statements and reconciliations

• Monthly bank statements for all operating accounts.
• Bank reconciliations demonstrating that cash receipts and payments agree with ledger entries.

Contracts, customs and payroll

• Customer and supplier contracts, especially those with cross-border elements or variable consideration.
• Customs declarations, bills of lading and import VAT evidence.
• Payroll registers, employee benefit schedules and end-of-service provisions relevant to Zakat base adjustments.

Zakat computation working papers

• Audited financial statements for the Zakat year.
• Detailed computation showing additions and deductions from the Zakat base.
• Shareholder equity roll-forwards and inter-company balance schedules.

E‑invoicing system logs and API call records

• API request and response logs from the FATOORA integration, timestamped and indexed by invoice ID.
• Error logs showing rejected payloads and corrective resubmissions.
• Solution-provider certification documentation confirming the system meets ZATCA technical requirements.

Record retention periods

Maintaining a consistent file-naming convention, for example, INV-2026-001234_XML_cleared.xml, materially speeds up evidence assembly when a ZATCA audit notice arrives.

E‑Invoicing Phase 2 (FATOORA): What ZATCA Auditors Will Request

Phase 2, the “Integration Phase”, requires taxpayers to transmit invoice data electronically to ZATCA’s FATOORA platform in a structured format. Unlike Phase 1, which focused primarily on generating invoices in a compliant electronic format, Phase 2 demands real-time or near-real-time clearance (for B2B standard invoices) and reporting (for B2C simplified invoices). Understanding how to prepare for ZATCA audits under this phase means demonstrating end-to-end system compliance.

FATOORA production versus simulation

The ZATCA FATOORA portal operates in two environments. The simulation environment allows taxpayers to test their integration, validate payload structures and resolve errors before going live. The production environment processes real invoices. Auditors may request evidence from both: simulation logs demonstrate that the system was properly tested, while production logs confirm ongoing compliance. Taxpayers access the FATOORA production system using their ERAD credentials through the ZATCA login portal.

Required evidence for Phase 2 compliance

• XML/UBL 2.1 payloads. Every invoice and associated note must be generated in the prescribed UBL 2.1 XML format containing all mandatory fields (seller and buyer VAT identification numbers, invoice ID, timestamp, line-item details, VAT category codes and totals).
• Cryptographic stamp and QR code. Invoices must carry a valid cryptographic stamp generated by a compliant e‑invoicing solution. Simplified invoices must include a readable QR code embedding specified data elements.
• Clearance and reporting status. For each invoice, retain the ZATCA clearance response (standard invoices) or reporting acknowledgement (simplified invoices) as proof of successful transmission.
• Solution-provider certification. If you use a third-party e‑invoicing solution, auditors may ask for evidence that the provider appears in ZATCA’s Solution Providers Directory and that the solution version in use has passed conformance testing.

ERP integration and reconciliation with accounting

A common audit finding is a mismatch between the totals in FATOORA-cleared invoices and the amounts recorded in the general ledger. To close this gap, finance teams should run automated reconciliation routines that match each FATOORA invoice UUID to the corresponding GL posting. Any discrepancies, timing differences, credit notes, foreign-currency revaluations, should be documented with explanatory notes.

Reporting obligations by e‑invoicing phase, comparison table

How ZATCA Selects and Conducts Audits: Process and Timelines

ZATCA employs a risk-based approach to audit selection, consistent with OECD-recommended tax-administration practices. The authority’s risk engine analyses filed returns, FATOORA data, customs declarations and third-party information to identify taxpayers whose profiles warrant closer review.

Desk audits versus field audits

A desk audit is conducted remotely: ZATCA issues a written request for specified documents, which the taxpayer uploads through the ZATCA portal or delivers electronically. A field audit involves on-site inspection of records, systems and physical operations. The scope and type of audit may escalate if desk-audit responses raise additional questions.

VAT audit triggers and common selection criteria

• Significant variance between reported output VAT and FATOORA-cleared invoice totals.
• Persistently high input-VAT claims relative to industry benchmarks.
• Late or amended returns filed in consecutive periods.
• Cross-border transactions lacking adequate customs or reverse-charge documentation.
• Random selection as part of ZATCA’s compliance-programme coverage targets.

Typical ZATCA audit timeline

Penalties, Interest and Fastest Mitigation Steps

ZATCA’s penalty framework covers a range of offences relevant to audit readiness. Finance teams that understand the penalty exposure can prioritise remediation where the risk is greatest. The ZATCA guidelines published under the E‑Invoicing Detailed Guidelines and the broader tax regulations establish the following categories.

Penalty matrix

Immediate remediation checklist

• Run a self-assessment of e‑invoicing compliance by comparing recent FATOORA payloads against ZATCA’s published technical specifications.
• Identify and file any overdue or amended returns before receiving an audit notification, voluntary disclosure generally results in lower penalties.
• Document any remediation steps taken so that auditors can see evidence of good faith and corrective action.

Responding to a ZATCA Audit Notice: Recommended Workflow

Receiving a ZATCA audit notice requires a structured, time-sensitive response. The following workflow is organised around three critical milestones.

Days 1–7: triage and owner assignment

• Log the notice in your compliance-management system with the date received, audit scope and assigned ZATCA officer reference.
• Appoint an internal audit-response owner, typically the tax manager or head of finance.
• Notify external legal or tax advisors if the audit scope covers areas of known exposure.
• Confirm that all ZATCA portal and FATOORA login credentials are current and accessible.

Days 7–30: evidence pack assembly

• Compile all documents specified in the audit notice: VAT returns, ledgers, FATOORA XML payloads, reconciliations and contracts.
• Prepare a period-by-period reconciliation between filed returns and general-ledger balances.
• Generate FATOORA API log exports for the periods under review.
• Review internal-control documentation to ensure it is current and complete.

Days 30–90: communications with ZATCA and legal controls

• Submit the evidence pack within the deadline specified in the audit notice.
• Maintain a written log of all communications with ZATCA, dates, channel, content summary and officer name.
• Where legal privilege may apply (e.g., legal opinions on tax positions), consult counsel before disclosing.
• Respond to supplementary requests promptly; delays may trigger cooperation-failure penalties.

Appeals, Objections and Legal Remedies

If ZATCA issues an assessment that a taxpayer believes is incorrect, a formal objection process is available. This process is a critical component of knowing how to prepare for ZATCA audits, preparation should include contingency planning for an adverse outcome.

Objection procedure

1. File within 60 days. A written objection must be submitted to ZATCA within 60 days of the date of the assessment notification.
2. Attach supporting evidence. The objection should include a detailed factual and legal basis, along with all supporting documents (reconciliations, contracts, expert opinions).
3. ZATCA review. ZATCA reviews the objection and may issue an amended or confirmed assessment.
4. Escalation to committees. If the objection is rejected, the taxpayer may escalate to the relevant tax dispute-resolution committees for independent review.
5. Further judicial appeal. Decisions of the committees may be appealed through the appellate committee structure established under Saudi tax law.

Early engagement with qualified legal counsel is advisable whenever the disputed amount is material or the legal position involves areas of interpretive uncertainty.

Conclusion: Five Actions to Take This Week

Preparing for ZATCA audits in 2026 is not a once-a-year exercise, it is an ongoing operational discipline. The convergence of Phase 2 e‑invoicing enforcement, updated ZATCA guidelines and risk-engine-driven audit selection means that gaps in records, systems or internal controls are more likely to be identified and penalised than at any prior point. To summarise, the five highest-priority actions for every Saudi-based finance team are:

1. Reconcile every filed VAT return to the general ledger and resolve all variances.
2. Verify that FATOORA payloads match cleared invoices and that API logs are archived.
3. Update your record-retention policy to cover a minimum six-year window for all tax-relevant documents.
4. Run a self-assessment against the ZATCA penalty matrix and file voluntary amendments where needed.
5. Engage a qualified Saudi audit and tax advisor to review your readiness posture before, not after, an audit notice arrives.

Sources

1. ZATCA, E‑Invoicing Overview (English)
2. ZATCA, FATOORA Portal User Manual (English PDF)
3. ZATCA, Roll‑out Phases (E‑Invoicing)
4. ZATCA, Regulations of the ZATCA Board of Director’s Audit Committee (PDF)
5. ZATCA, E‑Invoicing Detailed Guidelines (FATOORAH) Announcement
6. ZATCA, About ZATCA
7. OECD, Tax Administration