PRACTITIONER REFERENCE
IRS audit red flags practitioners should recognize
Warning signs that a routine civil examination may be developing into something more serious — and when to stop ordinary handling immediately. General information only.
General information only. Not legal or tax advice. Not a substitute for professional judgment.
Stop-and-escalate flags
These flags should trigger immediate escalation to a senior partner or counsel — regardless of the notice type or where the matter appears to stand at that moment.
The notice references a Notice of Deficiency, Statutory Notice, 90-day letter, or Tax Court petition rights
The Tax Court petition deadline is absolute. Late filing eliminates prepayment judicial review. Escalate the same day.
The notice references a Final Notice of Intent to Levy, CDP rights, lien, levy, or seizure
Collection Due Process rights run on a hard 30-day clock. Missing the deadline significantly narrows the taxpayer's procedural options.
The IRS requests a taxpayer interview
Any interview request requires strategy-level review before any response is scheduled. The taxpayer's statements can be used against them.
The agent requests bank records, net worth information, foreign account records, cryptocurrency records, or third-party records
These requests often signal that the IRS is building a financial picture that goes beyond the return. Scope and intent need to be assessed before production.
The civil agent becomes unusually focused on intent, knowledge, concealment, cash transactions, or omitted income
Civil agents are not supposed to develop criminal cases — but they can identify and refer them. Unusual focus on intent is an early warning that the matter may have criminal overtones.
The civil audit pauses, shifts topic, or the agent stops returning calls and cancelling appointments without rescheduling
A pause or unexplained shift in a civil audit is one of the clearest warning signs that the matter may have been referred to or flagged for Criminal Investigation. Do not continue ordinary civil-audit handling.
The client wants to provide an explanation that may be false, incomplete, speculative, or not supported by contemporaneous records
False statements to the IRS — even in a civil context — can constitute a separate federal offense. This is a stop-everything moment.
The firm prepared the return and the IRS notice may imply a return-preparation error
Preparer exposure changes the firm's interests and may create conflicts. Partner-level review is required before any substantive response.
The client is upset, panicked, threatening to blame the firm, or demanding an immediate answer
Emotional pressure should not drive strategy. Escalate so the right person can manage the client relationship and the IRS matter on the right track.
The notice proposes penalties for fraud, accuracy, trust fund recovery, information returns, FBAR, or payroll tax
These penalties carry significant financial exposure and sometimes personal liability. They require partner-level strategy, not associate-level handling.
The correspondence involves IRS-CI, a Fraud Technical Advisor, or a Fraud Enforcement Advisor
The matter is no longer a routine civil examination. Counsel involvement should be assessed immediately.
Eggshell audit warning signs
An eggshell audit is a civil examination where the representative knows — or suspects — that criminal exposure exists on the return. If any of the following appear during an otherwise routine audit, stop ordinary handling and reassess immediately.
- The agent asks questions about whether the taxpayer knew about an omission or discrepancy — rather than just what the correct numbers are
- The agent requests records that go well beyond the scope of the original IDR — lifestyle, personal accounts, off-book transactions
- A Fraud Technical Advisor or Fraud Enforcement Advisor becomes involved in the examination
- The agent asks about cryptocurrency, foreign accounts, or cash-intensive transactions without those items being on the return
- The civil audit is temporarily suspended without explanation, followed by difficulty scheduling future appointments
- Multiple IRS personnel attend a client interview
- Chief counsel attorneys appear in the examination
- The client or a third party receives a summons
- An IRS-CI agent in plain clothes accompanies the revenue agent or appears at a meeting
These signs do not mean a criminal case has been opened — but they mean the matter is no longer appropriately handled as a routine civil examination. The practitioner's next move can either protect the client or create additional exposure.
What to do when you see these signs
The core steps are procedural and well-established — not novel:
- Stop ordinary audit handling. Do not continue producing documents, scheduling interviews, or making representations to the agent until the situation is re-evaluated.
- Do not tell the client the matter is routine. A safer phrase: "We are reviewing the scope and direction of this examination. We will advise you on next steps."
- Consult tax-controversy counsel. CPA privilege under §7525 does not extend to criminal-tax matters. The practitioner may need privilege-protected advice before taking any further steps.
- Preserve and do not alter records. Any alteration, destruction, or backdating of documents at this stage carries severe independent risk.
- Do not allow the client to speak with the agent without representation. Statements to government agents — even civil ones — can become evidence.
How TaxRiskOS handles high-risk notices
TaxRiskOS applies escalation logic at intake. For notice types that carry criminal-tax risk or hard procedural deadlines, the workflow shows a hard-stop panel — no checklist, no document list — and directs the practitioner to counsel. For IRS-CI contact specifically, the tool produces no workflow output at all.
FAQ
What is an eggshell audit?
An eggshell audit is a civil tax examination in which the practitioner knows — or suspects — that the return contains criminal-tax exposure, but the IRS has not yet formally referred the matter to Criminal Investigation. The 'eggshell' refers to the fragility of the situation: ordinary audit-handling behavior can create additional criminal exposure if it is not managed carefully.
What is a reverse eggshell audit?
A reverse eggshell audit is the mirror image: the IRS may already have information suggesting fraud, but the taxpayer and representative do not know that. Civil agents may ask questions to which the government already has the answer. If the taxpayer's responses are false or inconsistent, those statements can become additional evidence of fraud.
Does CPA privilege apply if the audit becomes criminal?
No. The federally authorized tax practitioner privilege under IRC §7525 applies only to tax advice in non-criminal tax matters. It does not provide the same protection in criminal tax proceedings. This is one reason why practitioners should consult counsel — not just adjust audit strategy — when criminal-tax warning signs appear.
What should a CPA do if they see these warning signs during an audit?
Stop ordinary audit handling. Do not continue producing documents, scheduling interviews, or making representations to the agent without re-evaluating the situation. Internal materials and Circular 230 §10.21 require the practitioner to advise the taxpayer of noncompliance and its consequences. Consult with or refer to a tax-controversy attorney before any further substantive steps. General information only — this is not legal advice.
Where does TaxRiskOS flag these warning signs?
TaxRiskOS surfaces the escalation tier and stops the checklist workflow for high-risk notice types — showing a 'Stop / Get counsel first' panel instead of a document checklist. For notices in the IRS-CI category, the tool refuses to produce a workflow output entirely and directs the practitioner to counsel.