diff --git a/atst/routes/task_orders/new.py b/atst/routes/task_orders/new.py
index edb52150..f0a4a704 100644
--- a/atst/routes/task_orders/new.py
+++ b/atst/routes/task_orders/new.py
@@ -38,6 +38,8 @@ def edit(portfolio_id=None, task_order_id=None):
 @task_orders_bp.route("/task_orders/<task_order_id>", methods=["POST"])
 @user_can(Permissions.CREATE_TASK_ORDER, message="create new task order")
 def update(portfolio_id=None, task_order_id=None):
+    # TODO: I think saving and incomplete TO and saving a finished one should
+    # be different routes. It would make the route functions more readable.
     form_data = {**http_request.form, **http_request.files}
 
     form = None
@@ -55,14 +57,18 @@ def update(portfolio_id=None, task_order_id=None):
         else:
             task_order = TaskOrders.create(g.current_user, portfolio_id, **form.data)
 
+        # TO is finished and user can review and submit
         if task_order.is_completed and http_request.args.get("review"):
             return redirect(
                 url_for("task_orders.review_task_order", task_order_id=task_order.id)
             )
-
-        flash("task_order_draft")
-
-        if task_order.is_completed:
+        # User is trying to review and submit but the TO is not finished
+        elif http_request.args.get("review"):
+            return render_task_orders_edit(portfolio_id, task_order_id, form), 400
+        # User is saving valid but incomplete TO state
+        else:
+            flash("task_order_draft")
             return redirect(url_for("task_orders.edit", task_order_id=task_order.id))
 
-    return render_task_orders_edit(portfolio_id, task_order_id, form), 400
+    else:
+        return render_task_orders_edit(portfolio_id, task_order_id, form), 400
diff --git a/tests/routes/task_orders/test_new.py b/tests/routes/task_orders/test_new.py
index abe9ca6d..5dad287c 100644
--- a/tests/routes/task_orders/test_new.py
+++ b/tests/routes/task_orders/test_new.py
@@ -66,6 +66,24 @@ def test_task_orders_update(client, user_session, portfolio):
     assert task_order.pdf.filename == pdf_upload.filename
 
 
+def test_task_orders_save_incomplete(client, user_session, portfolio):
+    user_session(portfolio.owner)
+    form_data = {
+        "number": "0123456789",
+        "clins-0-jedi_clin_type": "JEDI_CLIN_1",
+        "clins-0-clin_number": "12312",
+    }
+    response = client.post(
+        url_for("task_orders.update", portfolio_id=portfolio.id), data=form_data
+    )
+    assert response.status_code == 302
+    task_order = portfolio.task_orders[0]
+    expected_url = url_for(
+        "task_orders.edit", task_order_id=task_order.id, _external=True
+    )
+    assert response.location == expected_url
+
+
 def test_task_orders_edit_existing_to(client, user_session, task_order):
     user_session(task_order.creator)
     response = client.get(url_for("task_orders.edit", task_order_id=task_order.id))
@@ -109,7 +127,7 @@ def test_task_orders_update(client, user_session, portfolio, pdf_upload):
         url_for("task_orders.update", task_order_id=task_order.id), data=data
     )
     assert task_order.number == data["number"]
-    assert response.status_code == 400
+    assert response.status_code == 302
 
 
 def test_task_orders_update_pdf(
@@ -122,7 +140,7 @@ def test_task_orders_update_pdf(
         url_for("task_orders.update", task_order_id=task_order.id), data=data
     )
     assert task_order.pdf.filename == pdf_upload2.filename
-    assert response.status_code == 400
+    assert response.status_code == 302
 
 
 def test_task_orders_update_delete_pdf(client, user_session, portfolio, pdf_upload):
@@ -133,7 +151,7 @@ def test_task_orders_update_delete_pdf(client, user_session, portfolio, pdf_uplo
         url_for("task_orders.update", task_order_id=task_order.id), data=data
     )
     assert task_order.pdf is None
-    assert response.status_code == 400
+    assert response.status_code == 302
 
 
 def test_cannot_get_to_review_screen_with_incomplete_data(