SARS has been steadily automating its enforcement — AI-driven risk selection, faster debt collection, and stricter submission requirements. For SMEs, being audit-ready is no longer something to prepare for. It is something to maintain.
SARS has been building its enforcement capacity methodically over the past several years. The results are becoming visible to businesses that previously managed with a degree of informality: faster identification of submission gaps, automated penalty assessments, and a broader net that flags amounts that would once have been too small to attract attention. For South African SMEs, this shift has a direct practical implication — being audit-ready is no longer something you do once before a formal audit. It is a condition that needs to be maintained, because the gap between a SARS query and a formal audit has narrowed. This post covers: - How SARS enforcement has changed in practice - What "audit-ready" means for an SME - The areas that attract scrutiny most frequently - What maintaining audit readiness involves ## How SARS Enforcement Has Changed SARS has invested substantially in automated data matching and risk profiling. This means inconsistencies between what an employer submits on an EMP201 and what their bank records or third-party data suggest are now identified algorithmically rather than waiting for a human audit trigger. Small employers with historically inconsistent submissions are now more likely to receive verification requests or auto-assessments than they were five years ago. The ITRN enforcement change from February 2026 — where EMP501 reconciliations with missing employee tax numbers are now rejected rather than warned — is one visible expression of this direction. Another is SARS's increased focus on outstanding debt collection, with automated follow-up on even small balances. The overall direction is consistent: enforcement is becoming faster, broader, and less dependent on a human deciding to investigate. > Audit-readiness used to be a state you prepared for. In 2026, it is a condition you need to maintain — because the time between a data mismatch and a SARS query has shortened considerably. ## What "Audit-Ready" Means for an SME Audit-ready does not mean having a dedicated compliance team or running the administration of a listed company. For an SME, it means two things: current records and correct processes. Current records means reconciliations are not deferred, bank statements are matched to submissions, and payroll records for the current year can be produced on request. It means employee files are complete, ITRN numbers are on record for every qualifying employee, and source documents for VAT claims are filed against the returns they supported. Correct processes means submissions go out on time, calculations follow the correct method, and changes — new employees, salary increases, benefit adjustments — are reflected in the system in the month they occur rather than at year end. Neither of these is technically demanding. Both require discipline and, for most SMEs, a designated person or service with primary responsibility for maintaining them. ## Areas That Attract Scrutiny Most Frequently **Payroll and PAYE.** The combination of the ITRN enforcement change and SARS's ongoing focus on employer compliance makes payroll the highest-risk area for most small employers. Incorrect PAYE calculations, missing employee tax registrations, and EMP501 reconciliations that do not match monthly EMP201 submissions are all flagged in the automated system. **VAT.** Input tax claims without adequate documentation, categorisation of exempt or zero-rated supplies as standard-rated, and returns that don't reconcile to accounting records attract verification requests. VAT audits tend to be document-intensive — the response burden alone is significant if records are disorganised. **Provisional tax.** For businesses where provisional tax is not calculated carefully, the gap between what was estimated and what was owed can attract interest and penalties. Accurate current-year records make provisional tax estimates more reliable. ## What Maintaining Audit Readiness Involves The practical requirements for maintaining audit readiness in an SME are modest in scope but unforgiving in rhythm: Monthly bank reconciliations that close the same month they cover. Payroll records maintained and stored contemporaneously. EMP201 submissions filed by the seventh. VAT returns filed on the correct cycle with source documents filed to match. Employee files current and complete. None of this is new. What has changed is the consequence of not doing it — because the system that identifies the gap is faster, and the window between the gap appearing and SARS acting on it is shorter. ## How Atlan Maintains This for Clients Atlan manages payroll, compliance submissions, and bookkeeping on a structured cycle — built around the deadlines that matter, with records maintained to the standard that a verification or audit request requires. For SMEs where the current admin structure has gaps, the first step is usually a compliance health check: confirming what is current, what has been missed, and what needs to be regularised before the on...