Tax Health Check in Indonesia: How to Identify Tax Risks Before a DJP Audit

A finance director reviews a Coretax notification, expecting a routine confirmation, and instead finds a data mismatch flag sitting quietly in the account. Nothing has happened yet. No auditor has called, no letter has arrived. But the system has already noticed something the company itself never checked for, and by the time it becomes a formal inquiry, the company is reacting to a problem DJP found first rather than one it found and fixed on its own terms.

That gap, between what a company’s own books show and what DJP’s systems can already see, is exactly what a tax health check is built to close. It is not a compliance filing and not a response to an existing dispute. It is a deliberate, internal walk through the same categories the tax authority itself is scanning, done early enough that any mismatch gets corrected quietly rather than explained defensively.

 Why DJP Finds Problems Before Companies Do

Indonesia’s tax administration has moved decisively toward automated cross-referencing rather than manual case selection. Since Coretax became the backbone of tax administration in January 2025 under PMK No. 81 of 2024, filings are checked against third-party data essentially in real time, VAT invoices against buyer reporting, withholding slips against recipient income, and payment records against bank and customs data that DJP already receives independently of what any single taxpayer submits.

That data matching feeds into a risk-based compliance approach DJP itself has now formalized. Circular Letter SE-8/PJ/2026, issued 15 July 2026, sets out exactly this shift: taxpayer oversight is built around risk profiles generated from data analysis, and a Surat Permintaan Penjelasan atas Data, an SP2DK, gets issued specifically when that analysis flags an inconsistency worth asking about. One detail is worth sitting with, and it comes straight from DJP itself rather than commentary about the circular. Speaking days after the new guidance took effect, DJP’s Director of Education, Services, and Public Relations stated publicly that the average share of SP2DK letters that escalate into a formal audit sits below one percent, a figure tied to the escalation criteria in PMK 111/2025 and SE-05/PJ/2022 rather than to SE-8/PJ/2026 itself. Either way, the pattern holds. The clarification stage, not the audit itself, is where the overwhelming majority of tax risk actually gets resolved or defused. A company that can answer an SP2DK cleanly because it already knew the mismatch existed is in an entirely different position than one seeing the discrepancy for the first time in the clarification letter itself.

The Core Checks a Tax Health Check Actually Runs

Running a tax health check does not require reinventing anything. It means systematically reviewing the same handful of categories where DJP’s automated matching is most likely to surface a discrepancy, before that discrepancy surfaces on its own.

Equalization Between Tax Types and the General Ledger

The single most common source of an unwanted DJP inquiry is not a wrong number. It is two correct numbers that do not match each other across different filings.

• VAT output versus recognized revenue. Monthly VAT invoices issued should reconcile against revenue booked in the general ledger for the same period, and a persistent gap, even one that nets out fine over a full year, tends to draw attention precisely because DJP’s matching runs period by period, not annually.
• Withholding tax versus the expense ledger. PPh 23 and PPh 21 amounts withheld should tie back cleanly to the corresponding service fees and salary expenses recorded, since a mismatch here often signals either an unwithheld payment or a classification error that shifted an expense into the wrong tax category entirely.
• Annual corporate return versus the sum of monthly filings. The annual SPT Tahunan figures should trace back consistently to twelve months of PPh 25 installments and monthly VAT filings, and a health check that only looks at the annual return in isolation misses exactly the kind of cumulative drift that a full year of small monthly discrepancies can produce.

Related Party and Transfer Pricing Exposure

Any transaction with an affiliated entity, a management fee, an intercompany loan, a royalty payment, or a cost allocation, carries its own documentation burden under Indonesia’s transfer pricing rules, and a health check should confirm two things independently: that the pricing itself reflects the arm’s length principle, and that the underlying documentation, a Local File at minimum for companies above the applicable threshold, actually exists and is current rather than assumed to exist because it was prepared once several years ago.

Permanent Establishment Exposure for Foreign Operations

A company with no formally registered Indonesian entity, or with informal representative activity alongside a licensed one, carries a separate and frequently underestimated risk. Following the tightened standards under PMK 112/2025, activity that once seemed comfortably preparatory, a local employee taking meetings, a foreign staff member spending extended time on site, can now constitute a taxable permanent establishment even without any formal incorporation. A health check that only reviews the registered entity’s own filings while ignoring informal activity happening alongside it is checking half the picture.

Gross Margin and Industry Benchmarking

DJP’s risk profiling also draws on sector-level comparisons, so a company whose reported gross margin sits noticeably below what is typical for its declared business classification invites a question even when every individual transaction underlying that margin is entirely legitimate. Reviewing reported margins against publicly available industry benchmarks before DJP does is a low effort step that catches an otherwise invisible red flag early.

Explore Our Services Corporate Tax Compliance in Indonesia

What Happens If the Health Check Finds Something

Finding a discrepancy during an internal review is a substantially better outcome than DJP finding it first, but only if the company actually acts on what the check surfaces rather than filing the report away.

• A genuine underpayment can generally still be corrected through a voluntary amendment before any formal inquiry begins, which typically carries a materially lighter consequence than the same correction made after an audit has already started.
• A documentation gap, missing transfer pricing files or unclear related party agreements, needs to be closed on its own timeline, not scrambled together after a request for explanation sets a countdown running.
• A structural risk, such as informal activity that may be creating unintended permanent establishment exposure, needs a decision at the operational level, not just a note in a compliance file, since the exposure continues accumulating for as long as the underlying activity does.

Should a mismatch still escalate into a formal examination despite all of this, the procedural landscape itself has shifted too. Under PMK 15/2025, taxpayers now have a materially shorter five-day window to respond in writing to a Notification of Tax Audit Findings, down from the previous seven, alongside the right to request a discussion with the Tax Audit Quality Assurance Team before the final results meeting. Knowing those timelines in advance, rather than discovering them mid-audit, is itself part of what a health check should leave a company prepared for.

None of these checks function as a single annual event and then forgotten. A gross margin drift that looked fine in March can look very different by the following filing period, and a related party arrangement documented two years ago may no longer reflect how the business actually operates today. Running this review on a recurring rhythm, tied to filing cycles rather than treated as a one time audit preparation exercise, is what actually keeps a company ahead of a system built specifically to notice drift over time.

XPND’s tax team builds exactly this kind of recurring health check into ongoing compliance work, walking through equalization, transfer pricing documentation, permanent establishment exposure, and margin benchmarking on the same cadence DJP’s own systems run their comparisons. A company that finds its own mismatches first is not avoiding scrutiny. It is simply the one explaining a correction it already made, rather than one explaining a discrepancy it is seeing for the first time in someone else’s letter.