IRD Audit in Sri Lanka: What Happens Next

The letter says the Inland Revenue Department wants to see your records. Your stomach drops.

That reaction is normal. It's also, most of the time, bigger than the thing causing it. An IRD audit in Sri Lanka is not a mystery process with hidden stages. The Inland Revenue Act, No. 24 of 2017, spells out exactly what the Department can do, and those powers fit into two stages. Once you know the shape, the letter stops being a threat and becomes a to-do list.

This guide covers the stage before any dispute: what the IRD can ask for, when it can turn up, what you have to hand over, how far back it can go, and how the process ends. If you already have an assessment you disagree with, go straight to our guide on how to appeal a tax assessment.

What actually happens when the IRD audits your return in Sri Lanka?

Here's the thing that surprises most people. The Act doesn't lay out an audit procedure. There's no statutory "letter, then meeting, then findings" sequence, and no set number of stages. What the Act gives the Department is two sets of powers.

Stage one is gathering information. Section 123 lets the Department send you a notice asking for information or documents, or asking you to come in. Section 122 lets authorised officers enter premises and inspect records. People tend to call the first a "desk query" and the second a "field audit". Those are informal labels. In law, they're just two different information powers.

Stage two is the assessment. Once the Department has what it needs, an Assistant Commissioner can amend your self-assessment under Section 135, "based on such evidence as may be available and to the best of his judgement". Or nothing happens, and your return stands as filed.

There's one more thing worth knowing up front. Section 135 does not require the Department to warn you of a proposed adjustment, or to hear your side, before it issues an amended assessment. Your formal right to argue comes afterwards, through administrative review. That's why stage one matters so much. It's the part where your paperwork does the talking.

What can a Section 123 notice ask you for?

Section 123(1) is the workhorse. The Assistant Commissioner can require you, "by giving reasonable notice in writing or by electronic means", to do three things:

1. Furnish information the notice asks for, including information concerning another person.
2. Appear at a designated time and place to be examined, or to produce documents or other evidence in your control.
3. Produce documents, within the time specified in the notice, relating to your own tax affairs or anyone else's.

Notice what's missing. The Act doesn't set a fixed minimum number of days to respond. It says "reasonable notice", and the deadline is whatever the notice itself specifies. So read the date on the letter before anything else.

The power reaches beyond you, too. Section 123(1) lets the Commissioner require information from "any other person", and Section 123(2) specifically covers banks: the Commissioner can require a bank to furnish details of any account or other assets held on someone's behalf, or copies of bank statements. Section 123(3) extends the power to payments made to non-residents and to an employer's payment of remuneration and the tax deducted from it.

Can IRD officers come to your home or business?

Sometimes, and the rules depend on the kind of place. Section 122 splits it three ways:

"Business premises" is defined broadly in Section 122(14). It includes any place where business is carried on or anything is done in connection with a business, a dwelling used for the maintenance of stocks, keeping of records, signing of contracts or agreements, or attesting of deeds, and "any place used for meeting clients". So if you freelance from a home office where you meet clients, that room may count as business premises.

Entry isn't a fishing licence, though. It has to be for an "authorised purpose", which Section 122(14) limits to collecting information to determine a person's tax liability, to collect tax from a specific person, or for investigating or prosecuting a specific person for an offence under the Act. An "authorised officer" is a Department official authorised in writing by the Commissioner-General to perform that function.

Once lawfully inside, Section 122(4) lets the officer copy records, seize or seal records and other items that appear relevant, question anyone present, open and examine receptacles where records may be kept, operate any computer and take a record of the data on it, and count cash.

You keep some rights over what's taken. Under Section 122(10) you can examine and copy seized records during office hours, at your own expense. Under Section 122(11), the officer must sign for everything removed and return it within fourteen days of the end of the investigation or related proceedings.

Can you refuse to hand something over?

Almost never, and this is the part most people get wrong.

Section 123(5) says the notice power has effect "notwithstanding anything contrary in any written law relating to confidentiality, privilege, or the public interest", and it names bank secrecy and contractual duties of confidentiality specifically. So "that's confidential" and "that's privileged" are not grounds for refusing a Section 123 notice.

And holding something back has a sting in its tail. Section 122(8):

Where taxpayer or other specified person fails to provide any document required by the Commissioner General under this section or section 123 such document shall not be used by the taxpayer or other person in a judicial proceeding challenging an assessment, except with the agreement of the Commissioner General.

Read that twice. The receipt you didn't produce during the audit can't rescue you in court later, unless the Commissioner-General agrees. Since Section 141 puts the burden of proving an assessment wrong on you, a document you withheld is a document you may never get to use.

The one place your consent genuinely matters is your home. Section 122(2) needs your consent or a Magistrate's written authorisation. But the owner or lawful occupier of any premises where the power is exercised must provide "all reasonable facilities and assistance" to the officer, under Section 122(9).

Section 185A isn't only about audits, by the way. It also covers failing to register, file a return, or file an annual statement. Our guide to the 2026 tax penalty amendments walks through the wider changes.

Can someone deal with the IRD on your behalf?

For a Section 123 notice, yes. Section 115 lets the Commissioner-General specify when a taxpayer may designate an authorised representative, and the notice issued under it, effective from April 1, 2018, includes furnishing information required by an Assistant Commissioner and appearing at the time and place designated in a Section 123 notice.

Who counts as an authorised representative is set out in Section 195. For an individual, the list includes a member of the Institute of Chartered Accountants of Sri Lanka, an attorney-at-law, a member of the Sri Lanka Institute of Taxation, a regularly employed employee, and a relative, among others. The representative has to be authorised in writing.

For an on-site visit under Section 122, the Act is silent. It neither grants nor restricts a right to have a representative present. If you're weighing whether to bring in a professional at all, our guide on whether you need a tax agent is a useful starting point.

How long does an IRD audit take, and how far back can they go?

The Act doesn't set a maximum duration for an audit itself. There's no clock that says the Department must finish examining your return by a certain date.

What it does set is how long the Department has to act on what it finds. For a self-assessment, Section 135(2)(b) gives the Assistant Commissioner thirty months from the date you filed the return. So if you filed your 2025/2026 return on November 30, 2026, the ordinary window to amend it runs to May 30, 2029.

Two exceptions remove that limit entirely:

• Fraud, or gross or wilful neglect. Section 135(2)(a) allows an amendment "at any time".
• No return filed. Section 133(5) says a default assessment "may be made at any time".

Once an amended assessment has been served, the Department can go a little further in some cases. Our guide to appealing a tax assessment sets out those extension rules in full. The practical upshot for record keeping is that five years isn't always the finish line. Our tax record-keeping guide explains when you must keep records for longer.

What makes the IRD look at a return in the first place?

Honestly, the Act doesn't say. It publishes no selection criteria and no list of triggers, and anyone who tells you the IRD's internal rules for choosing returns is guessing.

What the Act does tell you is what the Department can check your return against. It can ask banks for your account details and statements (Section 123(2)), ask any person for information concerning another person (Section 123(1)), and require information about an employer's payment of remuneration and the tax deducted from it (Section 123(3)(b)). So the safest working assumption is simple: the figures in your return should match the figures other people hold about you.

There's one place the Act mentions an audit by name. Under Section 150(2A), a resident individual's refund claim of up to Rs. 180,000 for a year of assessment from April 1, 2025 must be paid within three months, before any tax audit. Larger claims don't get that fast track, so a big refund claim can mean an audit before the money arrives. Our tax refund guide covers the details.

And if you never filed at all, you're not waiting to be selected. A default assessment can arrive at any time.

How does an IRD audit end?

One of two ways. Either nothing happens and your return stands as filed, or you receive a notice of amended assessment.

That notice isn't vague. Section 135(5) requires it to specify:

• (a) the original assessment it relates to,
• (b) the amount of tax assessed and the basis for the amended assessment,
• (c) any penalty assessed,
• (d) any late payment interest,
• (e) the tax period,
• (f) a due date for payment not less than thirty days from service of the notice, and
• (g) the manner of objecting.

One catch: the new due date on the notice doesn't reset the clock on interest. Section 135(6) keeps the original due date for working out late payment penalty and interest. Our guide to amending a filed tax return explains how that plays out.

If you disagree, you have thirty days to request an administrative review in writing, under Section 139. That's where the dispute process begins, and our tax assessment appeal guide takes it from there. Remember Section 141 when you do: "The burden of proof shall be on the taxpayer or person making an objection to an assessment to show that the assessment is incorrect."

Is there any way to stop the IRD reopening your return?

For individuals, there's now a safe harbour. Section 135(7), inserted by the Inland Revenue (Amendment) Act, No. 11 of 2026 (certified June 3, 2026), applies from the year of assessment commencing April 1, 2025. Your return "shall be accepted as filed", and no amended or additional assessment can be made on it under Section 135, if you meet all three conditions:

1. You filed a return declaring tax payable of not less than 120% of the tax payable for the previous year of assessment.
2. You paid the full amount without claiming a refund.
3. You furnished an affidavit stating that no fraud, evasion, or wilful default has been committed.

So if your tax payable for 2024/2025 was Rs. 300,000, you'd need to declare and pay at least Rs. 360,000 for 2025/2026, with the affidavit, to qualify. For many people the 120% condition won't fit their income that year, and that's fine. It's an option, not an expectation.

What should you do the day an IRD notice arrives?

Keep it simple:

1. Find the date. Note the deadline in the notice and which section it's issued under.
2. Read exactly what's asked. Produce what the notice specifies, for the period it specifies. You don't need to volunteer a decade of paperwork.
3. Gather the source documents. Invoices, bank statements, contracts, delivery notes. Section 120(10) lists these among the source documents behind your records.
4. Decide who will respond. You, or an authorised representative appointed in writing.
5. Respond in writing and keep copies of everything you send and every date you sent it.
6. Watch for an assessment notice afterwards. If one arrives and you disagree, your thirty days for administrative review start from that notice.

An IRD audit is the Department asking you to show your working. If the working exists, and you can find it, most of the fear goes with it.