Why Cannabis Businesses Face a Higher Audit Risk Than Any Other Industry
Cannabis businesses operate at the intersection of every factor that increases audit probability: they handle large volumes of cash, they operate in a federally prohibited industry that receives targeted IRS enforcement, they are subject to state regulatory oversight that includes mandatory financial examinations, and many file tax returns with the unusual characteristics that 280E creates -- high gross revenue with minimal deductions and disproportionately large tax payments. The result is that cannabis businesses are audited at rates that dramatically exceed the average for U.S. businesses.
The IRS does not publish cannabis-specific audit statistics, but analysis of publicly available data and industry surveys indicates that cannabis Schedule C filers face audit rates exceeding 5%, compared to the overall individual audit rate of approximately 0.4% and the small business audit rate of approximately 1.3%. For cannabis businesses filing returns with gross receipts above $1M, the audit probability is estimated at 10-15%. These rates mean that a cannabis business operating for 5-7 years has a greater than 50% probability of facing at least one IRS examination.
State regulatory audits are even more frequent. Most state cannabis regulatory agencies conduct compliance audits on a regular cycle -- annually in some states, every 2-3 years in others -- and any complaint, discrepancy in seed-to-sale data, or random selection can trigger an additional examination. Between IRS audits and state compliance audits, a multi-year cannabis operator should consider audit preparation as a permanent operational function rather than an occasional exercise.
What Is the Difference Between an IRS Audit and a State Regulatory Audit?
Understanding the distinction between these two types of examinations is essential because they examine different records, apply different standards, and carry different consequences. Preparing for one does not adequately prepare you for the other, and both require their own specialized documentation and defense strategy.
IRS Cannabis Audits
An IRS audit of a cannabis business focuses primarily on three areas. The first and most significant area is the Section 280E COGS allocation. The IRS examiner will scrutinize the business's determination of which costs qualify as cost of goods sold under IRC Section 471 and the Section 263A Uniform Capitalization rules, and which costs have been improperly classified as COGS when they should be treated as non-deductible operating expenses. The examiner is specifically looking for operating expenses that have been reclassified as production costs without adequate documentation or a defensible methodology.
The second area is unreported income, which is a primary focus for any cash-intensive business. The IRS uses several methods to identify potential unreported income, including bank deposit analysis (comparing total bank deposits to reported revenue), markup analysis (comparing the business's gross margin to industry benchmarks), and cash flow analysis (comparing reported income to observed lifestyle and asset purchases of the business owners). For cannabis businesses that handle significant cash, the examiner may also request documentation of cash handling procedures, vault logs, and reconciliation between cash sales reported in the point-of-sale system and cash deposited in banking or recorded in the books.
The third area is employment tax compliance, including proper classification of workers as employees versus independent contractors, accurate calculation and timely deposit of payroll taxes, and compliance with Form 1099 reporting requirements for payments to non-employees. Cannabis businesses frequently use independent contractors for tasks like trimming, security, and transportation -- classifications that the IRS often challenges.
State Regulatory Audits
State cannabis audits focus on regulatory compliance rather than tax compliance. The primary areas of examination include seed-to-sale tracking accuracy (whether METRC or the state's designated tracking system matches physical inventory, sales records, and transfer manifests), license compliance (whether the business is operating within the scope of its license, maintaining required security measures, and adhering to operating hour restrictions and sales limits), product safety and testing compliance (whether all products have been tested by licensed laboratories, whether failed batches have been properly disposed of, and whether packaging and labeling meet state requirements), and financial reporting to the state (some states require cannabis businesses to file periodic financial statements with the regulatory agency).
The consequences of the two types of audits also differ fundamentally. An IRS audit results in financial penalties -- additional tax owed, interest on underpayment, and potentially accuracy-related penalties of 20% or fraud penalties of 75% of the underpayment. A state regulatory audit can result in license suspension or revocation, which threatens the existence of the business itself. Both are serious, but the existential risk from a state audit makes compliance preparation even more critical.
How Do You Build a 280E Defense for an IRS Audit?
The 280E COGS allocation is the battlefield on which most IRS cannabis audits are fought, and the quality of your defense preparation directly determines the financial outcome. Cannabis businesses that enter an IRS audit with a professionally prepared, well-documented COGS allocation study typically sustain adjustments of $0-$50,000. Businesses that enter an audit without such a study -- relying instead on their tax preparer's general knowledge or their own internal estimates -- typically face adjustments of $150,000-$500,000 or more, depending on the size of the operation and the years under examination.
The foundation of a 280E defense is the Section 263A cost allocation study. This study, which should be prepared by a CPA with specific cannabis 280E experience, identifies every cost incurred by the business, classifies each cost as either a direct production cost, an indirect cost allocable to production, or a non-production operating expense, and applies a defensible allocation methodology to distribute indirect costs between COGS and operating expenses based on the specific facts and circumstances of the operation.
For a cultivation operation, the 263A study allocates costs between the grow (production) function and the non-production functions. Direct production costs -- seeds, clones, nutrients, growing media, direct labor of cultivation employees -- are 100% allocable to COGS. Indirect costs -- facility rent, utilities, depreciation, quality control, sanitation -- are allocated to COGS based on the proportion of the facility and labor that supports the production function. A well-prepared study for a cultivation operation typically allocates 70-85% of total costs to COGS.
For a dispensary, the COGS allocation is more straightforward -- COGS is primarily the cost of purchasing inventory from suppliers -- but there are still important optimization opportunities. The cost of receiving, inspecting, and storing inventory before it is placed for sale can be allocated to COGS under Section 263A. The cost of the compliance personnel who handle the METRC tagging and verification of incoming inventory is arguably part of the cost of bringing inventory to a saleable condition. These allocations are smaller in dollar terms than cultivation COGS optimization but can still save a dispensary $20,000-$100,000 per year in federal taxes.
For vertically integrated operations that cultivate, process, and sell, the 263A study is the most complex and most valuable. The study must trace costs through multiple stages of production -- from cultivation through processing through retail -- and allocate indirect costs at each stage. The complexity creates both risk (more opportunities for the IRS to challenge allocations) and opportunity (more costs that can be legitimately allocated to production). A well-prepared study for a vertically integrated operation can allocate 60-75% of total costs to COGS, compared to 40-55% for a stand-alone dispensary.
What Documentation Does the IRS Examiner Want to See?
Beyond the COGS allocation study itself, the IRS examiner will request specific supporting documentation. Financial records include complete general ledger detail for all years under examination, bank statements for all business accounts (and personal accounts if the examiner suspects commingling), accounts payable and accounts receivable aging reports, payroll records including quarterly 941 filings and annual W-2 and 1099 summaries, and all tax returns filed for the examination period including income tax, payroll tax, and sales tax returns.
Production and operational records include METRC or seed-to-sale tracking reports showing all inventory transactions, production logs documenting cultivation cycles (planting dates, harvest dates, yields), processing records for manufacturing operations, waste disposal logs, and quality control testing results. These operational records are critical because the IRS examiner will cross-reference production data with financial records to verify that reported COGS is consistent with actual production activity. If the financial records show $2M in cultivation COGS but the production records show only enough cultivation activity to justify $1.5M, the examiner will disallow the $500,000 difference.
Cash handling documentation includes cash register tapes or point-of-sale system reports for every day of operation, daily cash reconciliation worksheets, cash pickup logs and armored transport receipts, vault access logs, and bank deposit records that can be matched to specific days' sales. The IRS is particularly aggressive about cash verification for cannabis businesses, and any gap between point-of-sale records and verifiable cash deposits will be treated as potential unreported income.
How Do You Prepare for a State Compliance Audit?
State compliance audits focus on regulatory adherence rather than tax compliance, and the preparation centers on demonstrating that the business has operated within the scope of its license and in compliance with all applicable state regulations.
METRC Reconciliation
The METRC reconciliation is the most critical element of state audit preparation. METRC (or the applicable state seed-to-sale tracking system) is the state's primary tool for monitoring the legal cannabis supply chain, and discrepancies between METRC data and your actual operations are the most common finding in state audits and the most frequent cause of enforcement actions.
A thorough METRC reconciliation involves comparing METRC inventory balances to physical inventory counts at a specific point in time, tracing every transfer recorded in METRC to a corresponding invoice, purchase order, or delivery manifest in your financial and operational records, verifying that every plant tag and package tag in METRC corresponds to actual physical inventory (and vice versa -- that no physical inventory exists without a corresponding METRC record), and reviewing all METRC adjustment entries (waste, theft, destruction) to ensure each adjustment is supported by documentation including photos, witness signatures, and regulatory notifications where required.
The reconciliation should be performed monthly as an ongoing operational discipline, and a comprehensive reconciliation covering the full period likely to be examined (typically 2-3 years) should be completed at least 90 days before an anticipated audit. Discrepancies identified during the reconciliation should be corrected in METRC (with supporting documentation for the correction) before the audit begins. Proactively correcting discrepancies demonstrates good faith and typically results in far more favorable audit outcomes than having the auditor discover the same discrepancies during the examination.
License Compliance Review
A license compliance review verifies that the business has maintained compliance with all conditions of its state license. Common areas of non-compliance that state auditors identify include expired or improperly posted licenses, security system deficiencies (cameras that are not recording, alarm systems that have not been tested, access control logs that are incomplete), operating outside of licensed hours, storing inventory in areas not covered by the license, and failure to maintain required insurance coverage. Each of these issues is individually correctable, but the cumulative effect of multiple minor compliance failures can escalate from a warning to a fine to license suspension.
Financial Statement Preparation
Some states require cannabis businesses to file annual or semi-annual financial statements with the regulatory agency, and the audit will verify the accuracy of those filings. Even in states that do not require financial filings, the state auditor may request financial records to verify that sales volume reported in METRC is consistent with the revenue reported on tax returns. Maintaining financial statements that are prepared in accordance with GAAP (or at minimum, consistently applied accounting methods) and that reconcile cleanly with seed-to-sale tracking data is an essential element of state audit preparation.
What Is the Ideal Timeline for Audit Preparation?
Effective audit preparation is a continuous process rather than a crisis response, but the intensity of preparation increases as an audit approaches. The ideal timeline involves three phases.
Ongoing preparation (continuous) includes monthly bank reconciliations and general ledger review, monthly METRC reconciliation with physical inventory counts, quarterly internal compliance review using a standardized checklist, quarterly estimated tax payments with current 280E impact calculations, and annual update of the Section 263A COGS allocation study by a cannabis-specialized CPA.
Pre-audit preparation (90-180 days before examination) includes a comprehensive METRC reconciliation for the full examination period, assembly of all financial documentation into an organized audit file (physical or digital), review and update of the COGS allocation study for all years under examination, engagement of cannabis-specialized legal counsel to manage communications with the examining agency, a mock audit conducted by your CPA that simulates the actual examination process and identifies weaknesses, and correction of any discrepancies or compliance issues identified during the preparation process.
Active audit management (during the examination) includes designating a single point of contact for all communications with the auditor (this should be your CPA for an IRS audit or your attorney for a state regulatory audit, not a business employee), providing requested documents promptly but only the specific documents requested (do not volunteer additional information or documents), maintaining a detailed log of every document provided, every question asked, and every response given, and conducting a weekly status review with your professional advisors to assess the examination's direction and prepare for anticipated requests.
What Are the Most Common Cannabis Audit Findings?
Understanding the findings that auditors most frequently identify helps operators focus their preparation on the highest-risk areas.
IRS Audit Findings
The most common IRS finding in cannabis audits is improper COGS classification -- operating expenses that have been reclassified as COGS without a defensible 263A allocation study. The typical scenario involves a cannabis business that has been deducting expenses labeled as COGS that include items like marketing salaries, administrative rent, or general business insurance that are clearly not production-related costs. The IRS disallows these deductions, reclassifies the costs as non-deductible operating expenses under 280E, and assesses additional tax plus interest and penalties on the underpayment. Average adjustments for COGS reclassification range from $100,000 to $500,000 per year under examination.
The second most common finding is unreported cash income. The IRS compares bank deposits to reported revenue and investigates any discrepancies. For cannabis businesses that handle large volumes of cash, even legitimate explanations for deposit discrepancies (personal funds deposited to business accounts, loan proceeds, intercompany transfers) can be difficult to prove without contemporaneous documentation. The IRS applies a presumption that unexplained deposits are unreported income, and the business bears the burden of proving otherwise.
The third finding is employment tax issues, including worker misclassification (treating employees as independent contractors to avoid payroll taxes and workers' compensation), failure to timely deposit payroll taxes (which creates trust fund recovery penalty liability for responsible persons), and inaccurate reporting of cash tips by employees.
State Audit Findings
The most common state regulatory finding is METRC discrepancies -- differences between seed-to-sale tracking data and physical inventory, financial records, or transfer documentation. These discrepancies can result from data entry errors, system glitches, failure to record waste or destruction in a timely manner, or -- in the worst case -- diversion of product outside the legal supply chain. State regulators treat METRC discrepancies seriously regardless of the cause, and significant unexplained discrepancies can result in license suspension pending investigation.
Other common state findings include security deficiencies (particularly camera coverage gaps and access control failures), recordkeeping failures (incomplete visitor logs, missing delivery manifests, inadequate waste documentation), and regulatory reporting errors or late filings.
When Should You Engage a CPA and Attorney for Cannabis Audit Defense?
The short answer is that your cannabis-specialized CPA should be engaged continuously -- not just when an audit is imminent -- because the COGS allocation study, financial record quality, and tax compliance that form the foundation of audit defense must be built and maintained over time. A CPA engaged three weeks before an IRS examination cannot reconstruct years of proper documentation.
Cannabis-specialized legal counsel should be engaged as soon as you receive an audit notification from either the IRS or your state regulatory agency. The attorney serves two critical functions. First, attorney-client privilege protects communications with your attorney from disclosure to the examining agency, which means sensitive discussions about potential exposure, negotiation strategy, and risk assessment should be conducted through your attorney rather than directly with your CPA (communications with a CPA are generally not privileged). Second, the attorney manages the communication process with the examining agency, ensures that only appropriate documents are provided in response to requests, and negotiates resolution of any proposed adjustments.
The cost of professional audit defense -- typically $20,000-$75,000 for a standard IRS examination and $10,000-$30,000 for a state compliance audit -- is almost always a fraction of the additional tax, penalties, or regulatory consequences that result from an unrepresented or under-represented audit. Cannabis businesses that attempt to handle IRS audits without specialized representation consistently face worse outcomes than those that invest in proper defense.
How Northstar Financial Advisory Prepares Cannabis Businesses for Audits
Northstar Financial Advisory provides comprehensive audit preparation and defense support for cannabis businesses facing IRS examinations and state regulatory audits. Our services include ongoing 280E COGS allocation studies that are updated annually and designed to withstand IRS scrutiny, quarterly internal compliance reviews that identify and correct issues before they become audit findings, pre-audit preparation including full METRC reconciliation, financial documentation assembly, and mock audits that simulate the actual examination process, and active audit support including document preparation, response drafting, and coordination with your legal counsel throughout the examination.
Our team has supported cannabis businesses through dozens of IRS examinations and state compliance audits across multiple states, and we bring the pattern recognition and technical expertise that come from deep, focused experience in cannabis tax and regulatory compliance. The businesses that achieve the best audit outcomes are those that prepare continuously rather than reactively, and Northstar provides the infrastructure to make that continuous preparation systematic and effective.
If your cannabis business has received an audit notice, is preparing for a potential examination, or simply wants to build the ongoing compliance infrastructure that minimizes audit risk and exposure, we welcome the opportunity to discuss how Northstar can support your business.