Written for Mexico. This analysis applies to Mexican federal tax law — ISR (income tax), IVA (VAT) and SAT rules — and cites Mexican statutes. Amounts are in Mexican pesos (MXN).
The SAT no longer chooses whom to audit by leafing through files: the choice is made by risk models that cross-check your CFDIs, returns, bank accounts and third parties automatically. These are the seven most common triggers — all machine-detectable, all fixable if you act before the information request arrives.
1. Bank deposits larger than your declared income
The oldest and most effective cross-check. For individuals it is called tax discrepancy (discrepancia fiscal, art. 91 LISR): if your outlays and deposits exceed your declared income, the difference is presumed to be omitted income and the burden of explaining it is yours. Undocumented family loans, poorly documented transfers between your own accounts, and undeclared asset sales are the classics. The fix: document the origin of every relevant flow before anyone asks.
2. Suppliers on the 69-B lists
If you bought from a taxpayer that was later published as an EFOS (a shell invoicer of nonexistent operations), you inherit the presumption that your transactions with it were nonexistent. The system links you on its own — the CFDI is the thread. Minimum protocol: check the art. 69-B CFF lists before contracting relevant suppliers, and keep a substance (materiality) file for each one.
3. Payroll that doesn't add up
Payroll CFDIs issued vs. withholdings remitted vs. IMSS contributions vs. the deduction on your annual return: four figures the SAT cross-checks against one another and against the IMSS. Systematic differences — salaries stamped but not remitted, salary-assimilated earners with no support, per diems in disguise — are among the most frequent causes of invitation letters.
4. Recurring tax losses with an active business
Declaring losses year after year while you invoice, run payroll and grow is statistically anomalous, and the SAT knows it. Having losses is not illegal; being unable to explain them is suspicious. If your case is genuine (expansion, long cycles), the working paper that reconstructs the loss is your insurance.
How many of these seven apply to your company today?
Strategium's preventive diagnostic runs exactly these cross-checks on your information — before the authority runs them — and hands you a traffic-light report with the corrections prioritized. The difference between self-correcting and being served an information request is measured in fines, surcharges at 2.07% a month and months of attrition.
5. A "not located" tax domicile
It sounds minor and it is lethal: if the verifier cannot find your domicile, your compliance opinion turns negative, your invoicing seals (CSD) can be restricted (art. 17-H Bis CFF) and you land on the radar. Virtual offices with no real presence and moves without notice to the RFC (taxpayer registry) are the typical causes. It is the cheapest mistake to prevent on the whole list.
6. Mass cancellation and replacement of CFDIs
Cancelling invoices past the deadline, replacing them in December, or issuing credit notes that "adjust" income at year-end: patterns the model detects by volume and seasonality. Every relevant cancellation must have a documented reason — and the deadline rules for cancelling were tightened in the CFF itself, so the room to maneuver you had in years past no longer exists.
7. Deductions growing faster than income
Your margin cannot keep shrinking indefinitely without an explanation. Deductions that grow 30% with flat income scream "personal spending inside the company" or "filler invoices." If the explanation is legitimate — investment, launch of a new line — the one-page business-reason memo spares you the difficult conversation.
Frequently asked questions
I received an invitation letter from the SAT — is that an audit?
Not formally: it is the step just before one. They are showing you the inconsistency they already detected and offering you a chance to self-correct. Ignoring it is the fast track to formal audit powers. This is the exact moment to get advice, because what you answer defines the file.
How often does the SAT review these inconsistencies?
The cross-checks of CFDIs and returns are continuous and automated; the letters and information requests go out in thematic waves (payroll, EFOS, discrepancy). There is no 'safe season'.
Does self-correcting put me on the radar?
On the contrary: spontaneous self-correction (before an information request) avoids fines on the taxes you correct and is the lowest-friction scenario. The radar has already seen you — the question is whether it finds you corrected or exposed.
Let's talk about your case
Every structure, every transaction and every family is different. The first step is always the same: an honest diagnostic of where you stand. Write to us on WhatsApp or call — a reply the same business day.