How the IRS Selects Returns for Audit
The IRS does not audit returns at random. While a small percentage of examinations are selected through the National Research Program (NRP) for statistical research purposes, the vast majority of audits begin because an automated system identified something on the return that deviates from expected patterns. Understanding these systems demystifies the audit selection process and reveals exactly where small business owners should focus their compliance efforts.
The Discriminant Function System
The Discriminant Function System, universally known as DIF, is the IRS's primary automated screening tool. DIF assigns every filed return a numeric score based on a statistical model that compares the return's characteristics against historical norms for returns with similar income levels, filing statuses, and industry classifications. The model identifies returns with the highest probability of producing a change in tax liability if examined. Returns with the highest DIF scores are pulled for review by human classifiers at IRS campuses, who examine the return manually and decide whether to open a formal audit.
The DIF model's specific variables and weightings are classified, but decades of practitioner experience and published IRS data have identified the characteristics that most strongly influence the score. Deductions that are disproportionately large relative to reported income, particularly for meals and entertainment, vehicle expenses, and home office deductions, consistently elevate DIF scores. Returns reporting large losses that offset other income sources are flagged, especially when the losses occur repeatedly. Businesses with very high gross receipts but very low net income relative to industry averages generate elevated scores because the pattern suggests either inflated deductions or underreported income.
The Automated Underreporter Program
The Automated Underreporter (AUR) program takes a fundamentally different approach. Rather than scoring the return as a whole, AUR matches specific income items reported on the return against third-party information returns filed with the IRS. Every W-2, 1099-NEC, 1099-MISC, 1099-INT, 1099-DIV, 1099-B, 1099-K, and K-1 filed by a payer is matched against the corresponding income reported by the recipient. When the IRS's records show income that does not appear on the taxpayer's return, the AUR program generates a CP2000 notice proposing additional tax.
AUR mismatches are among the most common audit triggers for small businesses, particularly when a business owner receives 1099-K income from payment processors like Square, Stripe, or PayPal that exceeds the gross receipts reported on Schedule C. The reporting threshold for Form 1099-K dropped to $5,000 for tax year 2024 and is scheduled to decrease further, meaning that an increasing number of small business transactions will generate information returns that the AUR program will match against filed tax returns.
What Deduction-to-Income Ratios Trigger IRS Scrutiny
The single most predictable audit trigger for small businesses is claiming deductions that are disproportionately high relative to reported income. The IRS maintains internal benchmarks, derived from its own audit data and the Statistics of Income (SOI) division's analysis of filed returns, that define "normal" deduction ratios for each industry and income level.
While the specific benchmarks are not published, practitioner experience and IRS audit guides provide reliable indicators. For Schedule C businesses, total deductions exceeding 52% of gross receipts are considered elevated for most service-based industries. Vehicle expenses exceeding $15,000 for a business that does not involve substantial driving (such as a consulting firm or design studio) will draw attention. Meals and entertainment deductions exceeding 5% of gross receipts are above the norm for most industries. Supplies and materials deductions that are inconsistent with the nature of the business, such as a law firm claiming $40,000 in supplies, will elevate the DIF score.
The concept is straightforward: the IRS knows what a typical business in your industry spends on each major expense category relative to its revenue. If your return shows a pattern that falls outside those norms, the statistical model flags it. This does not mean the deductions are incorrect. It means the IRS's algorithms have identified a higher-than-average probability that an examination would produce additional tax, and a human classifier will review the return to determine whether the deviation warrants a formal audit.
The defense against high-deduction scrutiny is documentation, not avoidance of legitimate deductions. If your business genuinely incurs $25,000 in vehicle expenses because your technicians drive to customer sites daily, the deduction is appropriate. But you must maintain contemporaneous mileage logs, vehicle expense records, and a clear business purpose for every trip. The IRS's position, confirmed in numerous Tax Court cases including Cohan v. Commissioner, is that deductions require substantiation, and the burden of proof falls on the taxpayer.
How Do Cash-Intensive Businesses Attract IRS Attention
Cash-intensive businesses, including restaurants, bars, salons, laundromats, car washes, vending operations, and cannabis dispensaries, face inherently elevated audit risk because cash transactions create opportunities for underreporting that electronic payment records do not. The IRS recognizes this and applies enhanced scrutiny to industries where cash receipts represent a significant portion of total revenue.
The IRS uses several techniques to detect unreported cash income. Bank deposit analysis compares total deposits in all known bank accounts against reported gross receipts. If deposits exceed reported revenue, the IRS presumes the difference is unreported income unless the taxpayer can identify the source of every deposit as a non-taxable item (such as loan proceeds, gifts, or transfers between accounts). Markup analysis examines the ratio of revenue to cost of goods sold and compares it to industry norms. A restaurant reporting $1,000,000 in food and beverage costs but only $1,800,000 in revenue (an 80% markup) when the industry average is 200% to 300% will be flagged for potential underreporting. Cash T analysis examines the taxpayer's total known expenditures (mortgage, rent, vehicle payments, credit card charges, living expenses) and compares them to reported income. If known expenditures exceed reported income plus non-taxable sources, the IRS infers that the difference represents unreported income.
Under the Bank Secrecy Act, businesses must file FinCEN Form 8300 for any cash transaction exceeding $10,000, or for related transactions that aggregate above $10,000 within a 24-hour period. Failure to file Form 8300 is a federal crime carrying penalties up to $250,000 and five years in prison for willful violations. The IRS Cross-Reference program matches Form 8300 filings against the taxpayer's reported income, and discrepancies generate automatic referrals for examination.
Why Cannabis Businesses Face the Highest Audit Rates Among Small Businesses
Cannabis businesses face a unique combination of audit triggers that push their examination rates to an estimated four to five times the overall small business audit rate. The primary driver is IRC Section 280E, which disallows all business deductions except cost of goods sold for businesses trafficking in Schedule I or II controlled substances. Because 280E eliminates the deductibility of operating expenses, the COGS figure on a cannabis tax return represents the only deduction available, making it the most scrutinized line item on the return.
The IRS has dedicated examination resources specifically to cannabis returns. The IRS Large Business and International (LB&I) division has identified cannabis as a compliance campaign, meaning that audit resources are specifically allocated to examining cannabis businesses regardless of DIF scores or other automated screening results. In practice, this means that a cannabis business does not need to have an unusual return to be selected for audit. The mere fact of operating in the cannabis industry places the business in a population that the IRS has designated for enhanced examination coverage.
The most common 280E audit adjustments involve reclassification of costs that the taxpayer included in COGS but that the IRS determines are properly classified as non-deductible operating expenses. Labor allocations are frequently challenged, particularly when a dispensary claims that a significant percentage of its labor force is engaged in production-related activities like inventory management and packaging rather than retail sales. Facility cost allocations based on square footage are scrutinized when the production-use percentage appears disproportionate to the visible layout of the facility. Intercompany management fees in dual-entity structures are examined under IRC Section 482 transfer pricing standards.
Cannabis operators should treat audit preparation as an ongoing operational requirement rather than a reactive exercise. This means maintaining a formal cost study with supporting workpapers, contemporaneous employee time records by activity category, facility floor plans with measured square footage allocations, and written intercompany agreements at arms-length terms.
What Is the Hobby Loss Rule and When Does the IRS Apply It
IRC Section 183, commonly called the hobby loss rule, applies when the IRS determines that an activity is not engaged in for profit. If a business is reclassified as a hobby, the taxpayer can no longer deduct losses from the activity against other income. Under current law (post-Tax Cuts and Jobs Act of 2017), hobby expenses are not deductible at all, even to the extent of hobby income. This means that a hobby classification results in the taxpayer paying income tax on the full gross revenue from the activity with no offsetting deductions.
The IRS applies a profit test as a starting point: if the activity has generated a profit in three of the last five consecutive tax years (two of seven for activities involving horses), there is a rebuttable presumption that the activity is engaged in for profit. Failing the profit test does not automatically make the activity a hobby, but it shifts the burden to the taxpayer to prove profit motive through other evidence.
The IRS and Tax Court evaluate nine factors in determining profit motive, established in Treas. Reg. 1.183-2(b). These include the manner in which the taxpayer carries on the activity (does the business keep professional records, have a business plan, and operate in a businesslike manner), the expertise of the taxpayer or their advisors, the time and effort expended by the taxpayer, the expectation that assets used in the activity may appreciate in value, the success of the taxpayer in carrying on other similar activities, the taxpayer's history of income or losses with respect to the activity, the amount of occasional profits earned, the financial status of the taxpayer (does the taxpayer have substantial income from other sources that the losses conveniently offset), and whether the activity has elements of personal pleasure or recreation.
The hobby loss rule is particularly dangerous for small business owners who operate side businesses in areas they are personally passionate about, such as photography, real estate flipping, horse breeding, farming, or craft production. If the business shows consistent losses and the IRS can argue that the primary motivation is personal enjoyment rather than profit, reclassification can result in substantial back taxes, interest, and accuracy-related penalties of 20%.
How Do Home Office Deductions Increase Audit Risk
The home office deduction under IRC Section 280A allows taxpayers who use a portion of their home exclusively and regularly for business purposes to deduct a proportionate share of housing costs including mortgage interest or rent, property taxes, utilities, insurance, and depreciation. The deduction is legitimate and widely used, but it is also one of the most frequently disallowed deductions in IRS examinations because taxpayers routinely fail to meet the strict requirements.
The exclusive use test requires that the portion of the home claimed as a business office be used exclusively for business. A spare bedroom that also serves as a guest room, a dining table that doubles as a workspace, or a den that is used for both business calls and family entertainment does not qualify. The IRS has consistently prevailed in Tax Court on this issue, as demonstrated in Hamacher v. Commissioner and numerous other cases. The only exception to the exclusive use test is for taxpayers who use part of their home for the regular storage of inventory or product samples, provided the home is the sole fixed location of the business.
The regular use test requires that the space be used on a continuing basis for business, not just occasionally. Working from home two days per month does not establish regular use.
The deduction amount is calculated either by the regular method (allocating actual expenses based on the percentage of home square footage used for business) or the simplified method ($5 per square foot, maximum 300 square feet, for a maximum deduction of $1,500). The simplified method was introduced specifically to reduce audit disputes, and taxpayers claiming modest home office deductions using this method face minimal audit risk. Taxpayers claiming the regular method with deductions exceeding $5,000 to $10,000, particularly in combination with other large Schedule C deductions, face substantially higher scrutiny.
What Are the Current IRS Audit Rates by Income Level
Understanding current audit rates provides essential context for assessing your own risk. The IRS publishes audit statistics annually in its Data Book, and the Transactional Records Access Clearinghouse (TRAC) at Syracuse University provides additional analysis.
For fiscal year 2023, the overall individual audit rate was 0.44%, or roughly 1 in 227 returns. However, this average conceals enormous variation by income level. Returns with total positive income under $25,000 were audited at a rate of approximately 0.7%, driven primarily by Earned Income Tax Credit (EITC) correspondence audits. Returns with total positive income between $25,000 and $200,000 were audited at approximately 0.3%, the lowest rate of any income group. Returns with total positive income between $200,000 and $1,000,000 were audited at approximately 0.5%. Returns with total positive income above $1,000,000 were audited at approximately 2.0%, and the rate climbs steeply for returns above $5,000,000 and $10,000,000.
For business returns, the audit rates differ by entity type. Sole proprietorships (Schedule C) with gross receipts between $25,000 and $100,000 were audited at approximately 0.8%, while those with gross receipts above $100,000 were audited at approximately 1.1%. S-Corporations were audited at approximately 0.3%. Partnerships were audited at approximately 0.4%. C-Corporations with assets under $10,000,000 were audited at approximately 0.7%, while those with assets above $10,000,000 face substantially higher rates.
The IRS has received significant funding through the Inflation Reduction Act of 2022, specifically earmarked for enforcement against high-income taxpayers and large businesses. The agency has publicly committed to not increasing audit rates for taxpayers earning under $400,000, but it has simultaneously announced plans to substantially increase examination coverage for returns above that threshold. Small business owners with income above $400,000 should expect meaningfully higher audit rates in 2025 and beyond.
How Does Cryptocurrency Create New Audit Triggers
Cryptocurrency has become the fastest-growing area of IRS enforcement focus. Beginning with tax year 2025, cryptocurrency exchanges are required to issue Form 1099-DA (Digital Assets) reporting the proceeds from sales, exchanges, and dispositions of digital assets. This form is analogous to the 1099-B that stock brokerages have filed for decades, and it will feed directly into the AUR matching program.
The IRS has already demonstrated its enforcement posture through John Doe summonses issued to major exchanges including Coinbase, Kraken, and Circle, compelling them to produce records of customers with substantial transaction volumes. The IRS has also hired blockchain analytics firms to trace transactions across wallets and identify taxpayers who have not reported gains.
The most common audit triggers related to cryptocurrency include failure to report any cryptocurrency transactions when the taxpayer checked "No" on the digital asset question (which appears on page 1 of Form 1040), despite exchange records showing sales or dispositions. Cost basis errors frequently arise because taxpayers use incorrect acquisition dates, fail to account for fees, or apply the wrong cost basis method across multiple wallets and exchanges. Unreported staking and mining income is taxable as ordinary income at the fair market value on the date received, and taxpayers who fail to report this income face both underreporter notices and accuracy-related penalties.
Small business owners who accept cryptocurrency as payment for goods or services face an additional layer of complexity. Each crypto payment received must be recorded at the fair market value on the date of receipt and reported as business income. If the crypto is held rather than immediately converted to cash, any subsequent gain or loss on disposition must also be reported.
What Should You Do If You Receive an IRS Audit Notice
Receiving an IRS audit notice is stressful, but understanding the process and your rights transforms the experience from a crisis into a manageable professional interaction. The first and most important step is to contact your tax professional immediately. Do not call the IRS yourself, do not send documents, and do not ignore the notice. Your CPA, enrolled agent, or tax attorney can represent you before the IRS under a Power of Attorney (Form 2848), meaning you may never need to interact with the IRS agent directly.
The audit notice will specify the type of examination (correspondence, office, or field), the tax year(s) under review, and the specific items the IRS wants to examine. Read the notice carefully and provide it to your tax advisor in full. The scope of the initial notice defines the starting boundaries of the audit, and a skilled representative will work to keep the examination within those boundaries rather than allowing it to expand into other issues.
Gather only the documents specifically requested. The notice will list the records the IRS wants to see. Provide exactly those records, organized clearly, with a cover letter from your representative explaining what is being provided and how it supports the position taken on the return. Volunteering additional information, extra tax years, or unsolicited explanations frequently backfires by giving the examiner new areas to investigate.
Know the statute of limitations. The IRS generally has three years from the filing date (or the due date, whichever is later) to assess additional tax. This period extends to six years if the IRS suspects a substantial understatement of income (more than 25% of gross income), and there is no statute of limitations for fraud or failure to file a return. The IRS may ask you to sign Form 872 to extend the statute of limitations. Your advisor should carefully evaluate whether signing is in your interest before agreeing.
Understand your appeal rights. If the audit results in a proposed adjustment you disagree with, you have the right to appeal within the IRS Office of Appeals before the case goes to Tax Court. The appeals process is often productive because Appeals Officers have settlement authority and are incentivized to resolve cases without litigation. Approximately 80% of cases that reach Appeals are resolved without going to court.
How Northstar Financial Advisory Helps Small Businesses Reduce Audit Risk
Audit prevention is not a product you buy once. It is a year-round discipline built into every transaction, every journal entry, and every tax position. At Northstar Financial Advisory, our approach to audit risk management begins with maintaining books that close cleanly every month, with reconciled bank accounts, properly classified expenses, and documented support for every significant deduction. Our tax preparation process includes a pre-filing review that evaluates every material position on the return against current IRS enforcement priorities and DIF score factors. When we identify a position that carries elevated audit risk, we discuss it with the client in advance, ensure the documentation is complete, and make a deliberate decision to file the position rather than discovering the exposure after an audit notice arrives.
For clients who do receive audit notices, we provide full representation before the IRS, from initial response through Appeals if necessary. Our goal in every examination is to resolve the issues at the lowest possible level with the smallest possible adjustment, and to ensure that the audit does not expand beyond its original scope.