"I'm too small for the SAT to audit me": the myth that has cost mid-size businesses the most

The line gets said with dinner-table confidence: "the SAT doesn't have the people to audit us all — it goes after the big ones." Does the SAT really only audit large companies? The premise is true and the conclusion is false. The SAT does have limited auditors, and it does concentrate its deep audits where there is more revenue to collect. What the myth ignores is that enforcement stopped needing auditors: now that every invoice in the country passes through its servers in real time, reviewing a small taxpayer costs what it costs to run a query. And the queries run themselves.

How the SAT selects today: the algorithm, not the auditor

Every CFDI you issue and receive, every stamped payroll receipt, every return, every DIOT (the VAT informative return) from your suppliers and the financial information the banks hand over by law — it all lives in the same database and is cross-checked automatically. You declared less than you invoiced; you stamped payroll whose withholdings you never remitted; you credited VAT from a supplier that appears on the 69-B blacklists; your deposits don't square with your income: each cross-check that fails generates a flag, and the flags turn into acts that need not a single auditor sitting in front of your books — invitation letters and deep surveillance (which are not audit powers, but are the official prelude to them), electronic reviews under art. 53-B CFF resolved through the tax mailbox, and the most surgical of all: the restriction of the digital seal certificate (art. 17-H Bis CFF), which shuts off your ability to invoice until you clear it up. None of those tools distinguishes by size; they distinguish by inconsistency.

What is true: some sins attract more than others

Not everything on this board weighs the same. Unremitted withholdings — the money you deducted from your workers and did not hand over —, VAT you collected but do not pay and the purchase of invoices are in a different category of severity: they stop being administrative errors and cross into tax-fraud territory, and on top of that they put your assets at the mercy of a third party's luck (when the invoice mill blows up, the splash hits you). We take all three apart, with their exact consequences, in the three capital tax sins — if you read a single prevention article, make it that one.

Your real risk profile (and how to lower it)

The practical consequence of the algorithmic model is liberating once you grasp it: your risk is manageable, because it depends on your consistency, not on your luck. The orderly mid-size firm — CFDIs that square with returns, withholdings remitted, verified suppliers, no personal discrepancies — has a very low risk profile even if it invoices tens of millions. The disorderly small one — chronic zeros against bank movement, half-stamped payroll, cheap suppliers of dubious origin — has the electronic review on the horizon even if it invoices two. The concrete triggers that put you in the crosshairs, and how to fix each one before they do it for you, are in the 7 mistakes that put you in the SAT's sights; you can run the initial X-ray of your situation yourself with our tax exposure diagnostic. Labels: operating consistently and documented — low risk, for real, regardless of size; known inconsistencies left uncorrected — countdown: spontaneous correction, before the requirement lands, is still the cheapest lever in all of tax law (it eliminates substantive penalties); assuming you are invisible because you're small — the myth this article came to bury.