IRS Audits

Eggshell Audit: When a Civil IRS Exam Hides Criminal Exposure (2026)

By Angeline Balsitis, EA · Reviewed by Melissa Ly, Chief Tax Officer · Published July 23, 2026 · Updated July 7, 2026 · Editorial Standards

The audit letter itself looks routine — a tax year, an appointment date, a list of documents. What it doesn't mention is the thing you already know: the cash deposits that never made it onto the return, the personal spending buried in the business accounts, the payroll paid outside the books. You're not just worried about owing money. You're worried about what happens if the examiner figures it out.

That situation has a name, and it has a playbook. Practitioners call it an eggshell audit — a routine civil exam conducted on top of a problem that could support a fraud penalty or a criminal charge, where every answer has to be true and almost nothing should be volunteered. The image below maps the path from routine exam to criminal referral — and the exits available at each stage — so you can see exactly where you stand before you say a word to anyone at the IRS.

What an eggshell audit actually is (and the reverse eggshell audit)

An eggshell audit is defined by an information gap: you know about a criminal-caliber problem on the return, and the civil examiner — so far — does not. The IRS never uses the term. It's defense-side vocabulary for the tightrope: the examiner is entitled to accurate answers and legitimate documents, but is not entitled to a confession, and your job is to close the exam in the civil lane without crossing into deception.

The mirror image is worse. In a reverse eggshell audit, the information gap runs the other way: the IRS already suspects fraud — from an informant, a bank report, or a related investigation — and the "civil" exam is partly a device for gathering evidence while you think you're arguing about receipts. Everything you hand the civil examiner can flow to investigators. If your exam was triggered by a tip from an ex-employee, an ex-spouse, or a business partner gone hostile, treat the reverse-eggshell possibility as live.

Why your return got picked — and why the exam still feels routine

Most eggshell audits open blind: the IRS selected the return for ordinary civil reasons and has no idea what's underneath. Common triggers for a small-business return include a computer scoring mismatch between reported income and lifestyle, 1099-K or 1099-NEC totals that exceed reported gross receipts, deposits that don't reconcile in a bank deposit method audit, and the elevated scrutiny that follows any cash business audit.

A smaller share open with suspicion already attached — a whistleblower claim, a referral from a state agency, or a pattern flagged in a related exam. You usually cannot tell from the opening letter which kind you have. That's precisely why the eggshell playbook treats every exam with a known problem as if the examiner might already know.

If your business runs on a Schedule C, the exam mechanics themselves are covered in our Schedule C audit guide; if the return under exam involves a pandemic-era credit, the ERC audit guide covers that track. How many years the IRS can reach — three by default, six for large omissions, forever for fraud — is covered in how far back can the IRS audit. This page is about the layer those guides don't cover: what to do when you know the answer to the examiner's question is one you can't afford to give carelessly.

What happens if you mishandle it: how a civil audit turns criminal

A civil examiner who develops firm indications of fraud is required to stop the audit and refer the case to IRS Criminal Investigation. The sequence is procedural, not personal, and it almost always starts with something the taxpayer said or handed over. Here is the order in which it unfolds:

1. The examiner spots badges of fraud. Unexplained deposits, two sets of records, inconsistent or shifting answers, altered documents, dealings in cash designed to avoid a paper trail. One badge invites questions; a cluster invites the next step.
2. A Fraud Technical Advisor gets involved. The audit continues on the surface, but the examiner is now being coached on developing fraud. Questions shift from what happened to why — intent is the element that separates a mistake from a crime.
3. The referral. With firm indications of fraud, the examiner suspends the exam and submits Form 2797 to Criminal Investigation. From your side, the audit simply "goes quiet" — meetings cancelled, calls unreturned, no explanation.
4. CI investigates. Special agents work the case with grand jury tools: bank summonses, interviews of your bookkeeper, your preparer, your customers. You may not learn it's criminal for months. What that looks like is covered in our IRS criminal investigation guide.
5. Prosecution — or the boomerang. If CI declines or the case resolves, the file returns to the civil side, now with the 75% civil fraud penalty on the table and, because fraud removes the assessment statute of limitations, every earlier year open for examination.

The honest context: only a small fraction of civil audits are ever referred, and the IRS's shrunken 2026 workforce has made referrals rarer still. But the fraction that are referred are overwhelmingly cases where the taxpayer lied to the examiner, produced doctored records, or talked their way from a money problem into an intent problem. The exposure gap is enormous, and it's laid out below.

Read that table bottom-up and the strategy writes itself: every rung you stay below is worth more than any deduction you could argue about. The difference between the 20% row and the 75% row — let alone the felony rows — is usually decided by conduct during the audit, not by what happened on the original return. The civil fraud penalty guide covers how the IRS proves that top civil rung.

Under audit with something you're afraid the examiner will find?

Before you sit for the first interview, get your audit letter reviewed free and confidentially. An experienced tax professional will tell you honestly whether this is an eggshell situation, whether an attorney needs to lead, and how the defense should be structured — before anything is said that can't be unsaid.

Get My Free Confidential Review Call (888) 825-7779

Your eggshell audit defense options — and when each is still available

Timing decides almost everything in an eggshell case. The single most valuable option — the IRS's formal IRS voluntary disclosure practice, which is designed to take criminal prosecution off the table for taxpayers who come forward — is only available before the IRS has your issue in its sights. Once the audit letter arrives, that door is closed for the years under exam, and the remaining options are about controlling the exam itself.

Two absolute rules sit underneath every option on that table. First: never lie. A false statement to an IRS employee is itself a felony, and it's usually easier to prove than the original tax issue. Second: never touch the records. No backdating, no recreating "lost" invoices, no cleanup of the books mid-exam. The defense works by controlling what flows to the examiner — never by falsifying it.

What the dollars look like: a worked example

Say you own a small business with employees, and over each of the last three years about $7,400 in cash receipts per year went into a personal account and never onto the return — $22,200 in total unreported income. The examiner's bank deposit analysis will surface those deposits. Here's the hypothetical arithmetic at roughly a 35% combined federal income and self-employment tax rate:

• Additional tax: about $2,590 per year — roughly $7,770 across the three years, plus interest running from each year's original due date.
• If closed as negligence: a 20% accuracy-related penalty adds about $1,554. Total exposure lands near $9,300 plus interest — painful, payable, over.
• If characterized as civil fraud: the penalty jumps to 75% — about $5,828 — and the statute of limitations disappears, so the IRS can reach back into every earlier year with the same pattern.
• If it goes criminal: the dollar amount stops mattering. $22,200 of knowingly omitted income can support a false-return charge; prosecutions are brought on smaller numbers when the intent evidence is clean.

Now add the payroll wrinkle, because for a business owner it's often the sharper edge: if any of that cash also paid workers off the books, unpaid employment taxes stack on top, and the Trust Fund Recovery Penalty attaches the withheld-tax portion to you personally — it survives even if the business closes. The spread between the $1,554 outcome and the open-ended one is not decided by the original $22,200. It's decided by how the audit is handled from the first phone call.

How to respond to an eggshell audit, step by step

1. Pause direct contact with the examiner. Ask to reschedule the first interview if it's imminent — one reschedule is routine and buys the time you need to get represented.
2. Preserve everything exactly as it is. Do not amend, alter, backdate, shred, or "clean up" a single record — obstruction is often easier to prove than the underlying tax issue.
3. Hire representation and file Form 2848. Once a power of attorney is on file, the IRS works through your representative — you never have to sit for the interview alone.
4. Quantify the exposure under privilege. Before anything is answered, your team maps every problem year and every dollar so strategy decisions are made with full information.
5. Control document production. Answer exactly what's asked, accurately, with nothing volunteered — and keep a log of every item that goes to the examiner.
6. Negotiate the civil close. The goal is a signed exam report with civil penalties — contested through appeals if the numbers are wrong — and no referral.

Step three is the hinge. The Form 2848 power of attorney is what legally moves the conversation away from you: examiners can still request your testimony, but routine questions, document requests, and meetings run through your representative — where a careless sentence can't become Exhibit A.

Who should represent you — and why privilege decides it

An eggshell audit is the one exam type where who represents you matters as much as how well. The reason is privilege. Attorney-client privilege survives a criminal turn; the limited federal practitioner privilege that covers EAs and CPAs under §7525 does not apply in criminal proceedings. Your longtime preparer — the person who knows the most — can be summoned to testify and to produce every workpaper in their file.

The standard structure for a genuine eggshell case is therefore attorney-led: a tax attorney directs strategy and, where deep accounting work is needed, hires the accountant under a Kovel agreement so the analysis stays inside the privilege. For exams where the underlying issue is aggressive-but-defensible rather than knowingly false, an experienced tax professional can run the defense with an attorney on standby. Where that line sits — and how to tell which side of it you're on — is the first question a competent reviewer will answer for you; our guide on whether you need a tax attorney for back taxes covers the broader decision.

One more structural point: never send the preparer who signed the questioned return in to defend it alone. Their interest in defending their own work, and their exposure as a potential witness, can quietly diverge from yours. If you're unsure how your exam should be staffed, a free confidential case review will map it before you commit to anything.

Signs a civil audit is turning criminal

The clearest sign a civil audit has gone criminal is that it suddenly goes silent. Because examiners must suspend the exam once fraud is firmly indicated, an abrupt, unexplained stop — cancelled meetings, unreturned calls, months of nothing — is the classic referral fingerprint. Watch also for:

• Re-requests for documents already provided, or demands for originals rather than copies — evidence preservation behavior.
• Intent questions: "Why did you deposit these here?" "Who decided how sales were recorded?" — why and who decided are fraud-development questions, not math questions.
• Third-party activity: summonses to your bank, contacts with customers, vendors, or your bookkeeper.
• Scope creep: prior and subsequent years pulled into the exam without a clear civil reason.
• Two special agents at your door. If credentials say "Criminal Investigation," the question phase is over. Be polite, take their cards, say you'll have counsel contact them — and say nothing else. Our guide to when the IRS refers a case to criminal investigation covers what happens from there.

Situations that raise (or lower) the stakes

Payroll on top of income. For a business owner with employees, the skeleton often has two bones: the unreported receipts and the payroll they funded. Employment-tax fraud — especially repeated non-deposit of withheld taxes — draws some of the sharpest criminal attention the IRS gives, and the trust-fund portion follows owners personally. If your books mix both issues, the exposure map must cover both before anyone answers a question.

A joint return. A spouse who signed the return is jointly liable for the tax, though the civil fraud penalty attaches only to the spouse who committed the fraud. In eggshell planning, spouses sometimes need separate advice — their interests are not automatically identical.

Multiple years with the same pattern. Repetition is intent evidence. Three years of identical skimming is far harder to frame as sloppiness than one — and once fraud is found for any year, the unlimited assessment window puts every prior year in reach.

A parallel state exam. State and federal agencies share information. Skimmed cash receipts understate sales tax as well as income tax, so a CDTFA sales tax audit in California — or its equivalent elsewhere — can seed a federal exam, and vice versa. An eggshell strategy has to account for every agency that will eventually see the same numbers.

Preparer-driven problems. If a promoter or preparer engineered the false position — inflated credits, invented deductions — your intent picture is very different from someone who cooked their own books. That distinction can be the whole defense, but it has to be developed deliberately, not blurted at an interview.

When you can handle this yourself

Not every nervous audit is an eggshell audit. If your worry is missing receipts, estimated mileage, or a deduction you took in good faith and can mostly reconstruct, you don't have criminal exposure — you have a substantiation problem, and plenty of taxpayers resolve those directly with the examiner or with modest help. Honest sloppiness is not fraud, and examiners see it every day.

The line is knowledge. If you knew income was left off, knew the records were false, or paid people in cash specifically to keep them invisible, handle nothing yourself — not the first phone call, not the "quick questions," not the document production. The same is true if the audit has already gone quiet, if third parties are being contacted, or if the years under exam involve off-books payroll. In those situations, experienced help doesn't just improve the outcome; it determines which legal universe the case ends in.

Terms you'll hear, decoded

• Badges of fraud — the conduct patterns examiners are trained to spot as fraud indicators: concealed income, false records, implausible explanations, cash structuring.
• Firm indications of fraud — the internal threshold that requires an examiner to suspend the civil audit and refer the case for criminal development.
• Form 2797 — the referral report an examiner files to send a suspected fraud case to IRS Criminal Investigation.
• Fraud Technical Advisor (FTA) — an IRS specialist who coaches examiners on developing fraud cases while the audit continues on the surface.
• Kovel agreement — an arrangement in which an attorney hires an accountant so the accounting work is protected by attorney-client privilege.
• Reverse eggshell audit — a civil exam in which the IRS already suspects fraud and may be gathering criminal evidence while the taxpayer believes it's routine.

For background on the exam process itself, the IRS's own overview of how IRS audits work and the IRS Criminal Investigation division page are the primary sources. If you hit procedural walls the normal channels can't fix, the independent Taxpayer Advocate Service exists for exactly that.

Eggshell audit questions, answered

Your next 24 hours

1. Find two things on your audit letter: the appointment or response date, and the exact tax years and forms under exam. Those two facts define the battlefield — and whether the first meeting needs to be rescedued to get representation in place. If a reschedule is needed, that request itself is routine.
2. Gather — but do not touch: the audit letter, the filed returns for the years listed, and the bank statements behind them. Set them aside exactly as they are. No amendments, no cleanup, no "fixing" the books.
3. Get a confidential review before you speak to the examiner. Send us the letter — just the letter — through the 2-minute form or call (888) 825-7779. You'll get an honest read on whether this is an eggshell situation, how the defense should be staffed, and what the first interview should look like — before a single answer goes on the record.

This guide is general information, not tax or legal advice for your specific situation. Eligibility for IRS programs depends on individual facts and circumstances; no outcome is guaranteed.

Related: facing a different exam? See cash business audit, Schedule C audit, and how far back can the IRS audit — or browse all guides.