Your accounting team probably has a folder somewhere — physical, digital, or both — with customer exemption certificates in it. The question is whether those certificates are current, organized by state and customer, and tracked for expiration. If the answer to any of those is no, the audit exposure is real, and the liability belongs to you, not the buyer.
What's Actually at Stake When You Make an Exempt Sale
When a business sells to an exempt buyer — a reseller, a manufacturer purchasing for production, a government entity — the sale is documented with an exemption certificate. That certificate is what protects the seller if an auditor later questions whether sales tax should have been collected. Without it, the transaction gets reclassified as taxable, and the seller is assessed for the uncollected tax, plus interest, plus penalties. The buyer walks away clean.
States conduct what's sometimes called a "three-invoice pull" during audits: they pull a sample of transactions, look for exempt sales, and request the certificate for each one. If even a handful are missing or expired, the auditor extrapolates that rate across the full audit period. What looks like a few missing documents can turn into a significant assessment — and that's before interest calculations.
The Expiration Problem Nobody Tracks
Exemption certificate rules are not uniform. In Florida, resale certificates expire every December 31 and must be renewed annually. In Alabama, certificates expire after one year from issuance. In Massachusetts, they're valid for 10 years. In California and New York, they generally remain valid indefinitely — as long as the information is accurate and current.
If your customers span multiple states, you're operating under multiple expiration regimes simultaneously. 53% of finance and tax professionals still manage exemption certificates manually or through a mix of manual and automated processes, according to a 2025 Avalara survey conducted by Hanover Research.¹ In practice, that means expiration dates tracked in spreadsheets, renewal requests sent by email, and no automated signal when a certificate goes stale. Auditors find those gaps. That's their job.
The Renewal Loop Nobody Wins
Getting a renewed certificate from a customer requires asking. Then asking again. Then following up. Buyers don't track their vendors' certificate expiration schedules — that's not their problem. So the seller has to manage the outreach, the reminders, and the follow-through.
Meanwhile, if an old certificate expires and a new one isn't on file, you have two bad options: start charging sales tax on an account that expects exempt treatment (which the customer won't like), or continue processing the sale without documentation (which creates audit exposure). Neither is a good position. The clean answer is a system that manages the renewal cycle before it becomes a problem — not a spreadsheet that captures when the certificate lapsed after the fact.
Why Manual Management Doesn't Scale
Manual certificate management works when your exempt customer list is small and your team has bandwidth to chase paperwork. Both of those conditions erode as you grow. More customers, more states, more certificate types, more expiration schedules — and the same staff.
The numbers tell the story clearly: only 3% of organizations have fully automated exemption certificate management, according to industry research.² That means the overwhelming majority are absorbing real compliance risk through manual processes or patchwork systems. Avalara cites that automation can reduce certificate management to a few hours of compliance review per month for teams that previously spent the equivalent of a part-time position on it. The cost of manual management isn't just audit risk — it's also the staff time that never shows up on a risk register.
Organizations using integrated ERP and tax technology platforms have seen compliance errors drop by as much as 55% and audit response time cut by over 40%.³ Those aren't abstract efficiency gains — they're direct reductions in audit exposure and remediation cost.
What Automated Certificate Management Looks Like Inside Business Central
Avalara Exemption Certificate Management integrates natively with Business Central so that certificate collection, validation, and storage happen inside the same system where your transactions are processed. When a sale is coded as exempt, the system checks whether a valid certificate is on file for that customer in that state. If one is missing or about to expire, the workflow prompts action before the sale is finalized or before the renewal window closes.
Certificates are stored digitally, organized by customer and jurisdiction, and retrievable when an auditor requests them. Renewal tracking is automated — your team gets flagged before a certificate lapses, not after. And Avalara validates certificate completeness against state-specific requirements, so the problem of accepting a technically invalid certificate gets caught at collection rather than at audit.
Available through Microsoft Marketplace, Avalara ECM applies toward your Azure commitment and integrates without custom development. The practical outcome is straightforward: fewer manual touchpoints, less audit risk, and finance staff freed to work on something other than chasing paperwork.
Western Computer has helped 1,250+ companies implement Dynamics 365 Business Central over 35+ years. Exemption certificate management comes up in nearly every distribution and manufacturing implementation we run — and it's almost always being handled more manually than it should be. If you want to evaluate where your process stands, let's talk.
